<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="1118">
<package pkgid="b86cd751a574a50d1d9909ec5e726b6a577489e5" name="adaptivemm" arch="aarch64">
  <version epoch="0" ver="2.1.0" rel="3.el10"/>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 1.3.0-2" date="1614686400">- Updated spec file for OL8 build. Exclude aarch64 until memoptimizer
  is ready for ARM. [Orabug: 32576514]</changelog>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 1.4.0-1" date="1616673600">- Various algorithm updates to reduce the possibility of OOM
  killer being invoked because of memoptimizer's actions
- Local patch with code cleanup [Orabug: 32563799]</changelog>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 1.4.2-1" date="1621252800">- New upstream release
- Fix crash on systems with less than 4G memory [Orabug: 32884653]</changelog>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 1.5.0-1" date="1627560000">- Update to new upstream release [Orabug: 33322490]
- Add support for one time initializations at start up
- Add support for tunables value updates upon change
  in number of hugepages on the system
- Add tuning of negative dentries cap on kernels that support it</changelog>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 2.0.0-1" date="1643112000">- Update to new upstream release [Orabug: 33820292]
- Changing name to adaptivemmd from memoptimizer
- Add Obsoletes keyword to spec file to ensure updates happen
  correctly
- Change a config option name to stop systemd from complaining
  about the characters used in name
- Ensure only one instance of daemon is running by using lock file</changelog>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 2.0.0-2" date="1644235200">- Minor update to comments in increase-verbosity.patch to update
  memoptimizer references to adaptivemm</changelog>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 2.0.1-1" date="1644408000">- Fix total memory calculation for ARM since it is slightly
  different from x86
- Remove restriction to not build package on aarch64</changelog>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 2.1.0-1" date="1702296000">- Add module to look for possible memory leaks</changelog>
  <changelog author="Sidhartha Kumar &lt;sidhartha.kumar@oracle.com&gt; - 2.1.0-2" date="1734350400">- Rebuild to v2.1.0 for OL8, OL9, and OL10
- v2.1.0 adds a module to look for possible memory leaks</changelog>
  <changelog author="Sidhartha Kumar &lt;sidhartha.kumar@oracle.com&gt; - 2.1.0-3" date="1747828800">- Increase log level in cmp_meminfo() [Orabug: 37768194]</changelog>
</package>
<package pkgid="77b45d330299351c844ef8ad4345d15e89e76345" name="adaptivemm" arch="src">
  <version epoch="0" ver="2.1.0" rel="3.el10"/>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 1.3.0-2" date="1614686400">- Updated spec file for OL8 build. Exclude aarch64 until memoptimizer
  is ready for ARM. [Orabug: 32576514]</changelog>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 1.4.0-1" date="1616673600">- Various algorithm updates to reduce the possibility of OOM
  killer being invoked because of memoptimizer's actions
- Local patch with code cleanup [Orabug: 32563799]</changelog>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 1.4.2-1" date="1621252800">- New upstream release
- Fix crash on systems with less than 4G memory [Orabug: 32884653]</changelog>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 1.5.0-1" date="1627560000">- Update to new upstream release [Orabug: 33322490]
- Add support for one time initializations at start up
- Add support for tunables value updates upon change
  in number of hugepages on the system
- Add tuning of negative dentries cap on kernels that support it</changelog>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 2.0.0-1" date="1643112000">- Update to new upstream release [Orabug: 33820292]
- Changing name to adaptivemmd from memoptimizer
- Add Obsoletes keyword to spec file to ensure updates happen
  correctly
- Change a config option name to stop systemd from complaining
  about the characters used in name
- Ensure only one instance of daemon is running by using lock file</changelog>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 2.0.0-2" date="1644235200">- Minor update to comments in increase-verbosity.patch to update
  memoptimizer references to adaptivemm</changelog>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 2.0.1-1" date="1644408000">- Fix total memory calculation for ARM since it is slightly
  different from x86
- Remove restriction to not build package on aarch64</changelog>
  <changelog author="Khalid Aziz &lt;khalid.aziz@oracle.com&gt; - 2.1.0-1" date="1702296000">- Add module to look for possible memory leaks</changelog>
  <changelog author="Sidhartha Kumar &lt;sidhartha.kumar@oracle.com&gt; - 2.1.0-2" date="1734350400">- Rebuild to v2.1.0 for OL8, OL9, and OL10
- v2.1.0 adds a module to look for possible memory leaks</changelog>
  <changelog author="Sidhartha Kumar &lt;sidhartha.kumar@oracle.com&gt; - 2.1.0-3" date="1747828800">- Increase log level in cmp_meminfo() [Orabug: 37768194]</changelog>
</package>
<package pkgid="dbe3dec03f061591a3dd7d78d14eaad3f0751c36" name="btrfs-progs" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="1.el10"/>
  <changelog author="Anand Jain &lt;anand.jain@oracle.com&gt; - 6.12.0-0.el10" date="1734264000">- btrfs-progs: upstream release v6.12.0</changelog>
  <changelog author="Anand Jain &lt;anand.jain@oracle.com&gt; - 6.12.0-1.el10" date="1736769600">- btrfs-progs: release 6.12.0-1 (Anand Jain)  
- btrfs-progs: resize: remove the misleading warning for the 'max' option (Anand Jain)  
- btrfs-progs: btrfstune: add ability to remove squotas (Boris Burkov)  
- btrfs-progs: add a helper for clearing all the items in a tree (Boris Burkov)  
- btrfs-progs: btrfstune: fix documentation for --enable-simple-quota (Boris Burkov)</changelog>
</package>
<package pkgid="8f27c3baf138f19d04506db770185f927185fd7f" name="btrfs-progs" arch="src">
  <version epoch="0" ver="6.12.0" rel="1.el10"/>
  <changelog author="Anand Jain &lt;anand.jain@oracle.com&gt; - 6.12.0-0.el10" date="1734264000">- btrfs-progs: upstream release v6.12.0</changelog>
  <changelog author="Anand Jain &lt;anand.jain@oracle.com&gt; - 6.12.0-1.el10" date="1736769600">- btrfs-progs: release 6.12.0-1 (Anand Jain)  
- btrfs-progs: resize: remove the misleading warning for the 'max' option (Anand Jain)  
- btrfs-progs: btrfstune: add ability to remove squotas (Boris Burkov)  
- btrfs-progs: add a helper for clearing all the items in a tree (Boris Burkov)  
- btrfs-progs: btrfstune: fix documentation for --enable-simple-quota (Boris Burkov)</changelog>
</package>
<package pkgid="cec5a05c3d55700e07b11f01b332db93661ee797" name="btrfs-progs-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="1.el10"/>
  <changelog author="Anand Jain &lt;anand.jain@oracle.com&gt; - 6.12.0-0.el10" date="1734264000">- btrfs-progs: upstream release v6.12.0</changelog>
  <changelog author="Anand Jain &lt;anand.jain@oracle.com&gt; - 6.12.0-1.el10" date="1736769600">- btrfs-progs: release 6.12.0-1 (Anand Jain)  
- btrfs-progs: resize: remove the misleading warning for the 'max' option (Anand Jain)  
- btrfs-progs: btrfstune: add ability to remove squotas (Boris Burkov)  
- btrfs-progs: add a helper for clearing all the items in a tree (Boris Burkov)  
- btrfs-progs: btrfstune: fix documentation for --enable-simple-quota (Boris Burkov)</changelog>
</package>
<package pkgid="c34cbc8605cacab2b4d059af5f14d34fc2ddfc04" name="dnf-plugins-extras" arch="src">
  <version epoch="0" ver="4.1.2" rel="3.0.1.el10"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.0.17-2" date="1674129600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild</changelog>
  <changelog author="Jan Kolarik &lt;jkolarik@redhat.com&gt; - 4.1.0-1" date="1680696000">- Update to 4.1.0
- Move system-upgrade plugin to core (RhBug:2054235)</changelog>
  <changelog author="Python Maint &lt;python-maint@redhat.com&gt; - 4.1.0-2" date="1686744000">- Rebuilt for Python 3.12
- Fixes: rhbz#2219977</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.1.0-3" date="1689768000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild</changelog>
  <changelog author="Jan Kolarik &lt;jkolarik@redhat.com&gt; - 4.1.1-1" date="1697716800">- Update to 4.1.1
- Translations update</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.1.1-2" date="1705665600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild</changelog>
  <changelog author="Jan Kolarik &lt;jkolarik@redhat.com&gt; - 4.1.2-1" date="1706097600">- Update to 4.1.2
- snapper: Add support for specifying snapper config name (RhBug:2089544)
- rpmconf: Implement unattended config option</changelog>
  <changelog author="Python Maint &lt;python-maint@redhat.com&gt; - 4.1.2-2" date="1717761600">- Rebuilt for Python 3.13</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.1.2-3" date="1721217600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 4.1.2-3.0.1" date="1742990400">- enable only a limited subset of plugins</changelog>
</package>
<package pkgid="23891e69bda27c222dc90255abefb87af248ef6f" name="dracut" arch="aarch64">
  <version epoch="0" ver="107" rel="3.0.3.el10"/>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-1" date="1739793600">- build: upgrade to dracut 105
- fix(systemd-ask-password): do not half-install systemd-ask-password-wall
- fix(pcsc): add libpcsclite_real.so.*
- revert: "fix(rescue): make rescue always no-hostonly"
- fix(dracut-install): initize fts pointer
- feat: add openssl module
- build: make erofs the default requirement for squash subpackage
  Resolves: RHEL-65204,RHEL-68935,RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-2" date="1739793601">- fix(openssl): harden ossl build CFLAGS
  Related: RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-3" date="1739793602">- fix(ossl): copy executables for the test suite</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-4" date="1741262400">- fix(rescue): create hmac file for rescue kernel</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-1" date="1752753600">- Upgrade to dracut 107
  Resolves: RHEL-97473</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-2" date="1754568000">- fix: improve hostonly sloppy mode
- fix(dracut.sh): don't pass empty string as dir
- feat(systemd): drop unnecessary dependency on libgcrypt
- fix(kernel-modules-extra): remove stray  before /
- Revert "fix(base): do not require chroot inside initramfs"
- fix: let check_vol_slaves_all return 1 when checks on all slaves fail
- improvement(74nvmf): lookup required NIC kernel modules for NBFT interfaces
- fix(74nvmf): set root=nvmf
  Resolves: RHEL-104223,RHEL-93173,RHEL-95542,RHEL-95897</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-3" date="1755518400">- test(SYSTEMD-INITRD): be more careful with `set -e` and subshells
- test: fixup NFS test.sh
  Resolves: RHEL-108215,RHEL-97473</changelog>
  <changelog author="EL Errata &lt;el-errata_ww@oracle.com&gt; - 107-3.0.1" date="1757073600">- Ship Oracle IMA certificate [Orabug: 35992862]
- Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
- Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
- network-legacy: Revert some shellcheck that breaks parse_option_121 in dhclient [Orabug: 33778173]
- Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
- Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
- Install missing 68-del-part-node.rules [Orabug: 32827579]
- Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
- dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
- Update list of necessary files after squashfs execution [Orabug: 29864620]
- Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
- Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
- Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
- Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
- 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
- Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828] (kevin.x.lyons@oracle.com)
- add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.2" date="1761912000">- Include correct modprobe into squashfs root [Orabug: 38559936]</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.3" date="1764676800">- Skip unneeded FIPS logic on UEK with special FIPS [Orabug: 38138800] [Orabug: 38709306]</changelog>
</package>
<package pkgid="34061e65cd27e45a820a2e1085d53017db26415a" name="dracut" arch="src">
  <version epoch="0" ver="107" rel="3.0.3.el10"/>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-1" date="1739793600">- build: upgrade to dracut 105
- fix(systemd-ask-password): do not half-install systemd-ask-password-wall
- fix(pcsc): add libpcsclite_real.so.*
- revert: "fix(rescue): make rescue always no-hostonly"
- fix(dracut-install): initize fts pointer
- feat: add openssl module
- build: make erofs the default requirement for squash subpackage
  Resolves: RHEL-65204,RHEL-68935,RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-2" date="1739793601">- fix(openssl): harden ossl build CFLAGS
  Related: RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-3" date="1739793602">- fix(ossl): copy executables for the test suite</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-4" date="1741262400">- fix(rescue): create hmac file for rescue kernel</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-1" date="1752753600">- Upgrade to dracut 107
  Resolves: RHEL-97473</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-2" date="1754568000">- fix: improve hostonly sloppy mode
- fix(dracut.sh): don't pass empty string as dir
- feat(systemd): drop unnecessary dependency on libgcrypt
- fix(kernel-modules-extra): remove stray  before /
- Revert "fix(base): do not require chroot inside initramfs"
- fix: let check_vol_slaves_all return 1 when checks on all slaves fail
- improvement(74nvmf): lookup required NIC kernel modules for NBFT interfaces
- fix(74nvmf): set root=nvmf
  Resolves: RHEL-104223,RHEL-93173,RHEL-95542,RHEL-95897</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-3" date="1755518400">- test(SYSTEMD-INITRD): be more careful with `set -e` and subshells
- test: fixup NFS test.sh
  Resolves: RHEL-108215,RHEL-97473</changelog>
  <changelog author="EL Errata &lt;el-errata_ww@oracle.com&gt; - 107-3.0.1" date="1757073600">- Ship Oracle IMA certificate [Orabug: 35992862]
- Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
- Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
- network-legacy: Revert some shellcheck that breaks parse_option_121 in dhclient [Orabug: 33778173]
- Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
- Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
- Install missing 68-del-part-node.rules [Orabug: 32827579]
- Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
- dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
- Update list of necessary files after squashfs execution [Orabug: 29864620]
- Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
- Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
- Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
- Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
- 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
- Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828] (kevin.x.lyons@oracle.com)
- add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.2" date="1761912000">- Include correct modprobe into squashfs root [Orabug: 38559936]</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.3" date="1764676800">- Skip unneeded FIPS logic on UEK with special FIPS [Orabug: 38138800] [Orabug: 38709306]</changelog>
</package>
<package pkgid="372368249d4260b38ef999f6756c3ebaaea009a6" name="dracut-caps" arch="aarch64">
  <version epoch="0" ver="107" rel="3.0.3.el10"/>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-1" date="1739793600">- build: upgrade to dracut 105
- fix(systemd-ask-password): do not half-install systemd-ask-password-wall
- fix(pcsc): add libpcsclite_real.so.*
- revert: "fix(rescue): make rescue always no-hostonly"
- fix(dracut-install): initize fts pointer
- feat: add openssl module
- build: make erofs the default requirement for squash subpackage
  Resolves: RHEL-65204,RHEL-68935,RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-2" date="1739793601">- fix(openssl): harden ossl build CFLAGS
  Related: RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-3" date="1739793602">- fix(ossl): copy executables for the test suite</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-4" date="1741262400">- fix(rescue): create hmac file for rescue kernel</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-1" date="1752753600">- Upgrade to dracut 107
  Resolves: RHEL-97473</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-2" date="1754568000">- fix: improve hostonly sloppy mode
- fix(dracut.sh): don't pass empty string as dir
- feat(systemd): drop unnecessary dependency on libgcrypt
- fix(kernel-modules-extra): remove stray  before /
- Revert "fix(base): do not require chroot inside initramfs"
- fix: let check_vol_slaves_all return 1 when checks on all slaves fail
- improvement(74nvmf): lookup required NIC kernel modules for NBFT interfaces
- fix(74nvmf): set root=nvmf
  Resolves: RHEL-104223,RHEL-93173,RHEL-95542,RHEL-95897</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-3" date="1755518400">- test(SYSTEMD-INITRD): be more careful with `set -e` and subshells
- test: fixup NFS test.sh
  Resolves: RHEL-108215,RHEL-97473</changelog>
  <changelog author="EL Errata &lt;el-errata_ww@oracle.com&gt; - 107-3.0.1" date="1757073600">- Ship Oracle IMA certificate [Orabug: 35992862]
- Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
- Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
- network-legacy: Revert some shellcheck that breaks parse_option_121 in dhclient [Orabug: 33778173]
- Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
- Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
- Install missing 68-del-part-node.rules [Orabug: 32827579]
- Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
- dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
- Update list of necessary files after squashfs execution [Orabug: 29864620]
- Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
- Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
- Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
- Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
- 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
- Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828] (kevin.x.lyons@oracle.com)
- add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.2" date="1761912000">- Include correct modprobe into squashfs root [Orabug: 38559936]</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.3" date="1764676800">- Skip unneeded FIPS logic on UEK with special FIPS [Orabug: 38138800] [Orabug: 38709306]</changelog>
</package>
<package pkgid="b13b96cd15a5e014fe835dd22c39d2f7ea19c1a1" name="dracut-config-generic" arch="aarch64">
  <version epoch="0" ver="107" rel="3.0.3.el10"/>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-1" date="1739793600">- build: upgrade to dracut 105
- fix(systemd-ask-password): do not half-install systemd-ask-password-wall
- fix(pcsc): add libpcsclite_real.so.*
- revert: "fix(rescue): make rescue always no-hostonly"
- fix(dracut-install): initize fts pointer
- feat: add openssl module
- build: make erofs the default requirement for squash subpackage
  Resolves: RHEL-65204,RHEL-68935,RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-2" date="1739793601">- fix(openssl): harden ossl build CFLAGS
  Related: RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-3" date="1739793602">- fix(ossl): copy executables for the test suite</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-4" date="1741262400">- fix(rescue): create hmac file for rescue kernel</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-1" date="1752753600">- Upgrade to dracut 107
  Resolves: RHEL-97473</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-2" date="1754568000">- fix: improve hostonly sloppy mode
- fix(dracut.sh): don't pass empty string as dir
- feat(systemd): drop unnecessary dependency on libgcrypt
- fix(kernel-modules-extra): remove stray  before /
- Revert "fix(base): do not require chroot inside initramfs"
- fix: let check_vol_slaves_all return 1 when checks on all slaves fail
- improvement(74nvmf): lookup required NIC kernel modules for NBFT interfaces
- fix(74nvmf): set root=nvmf
  Resolves: RHEL-104223,RHEL-93173,RHEL-95542,RHEL-95897</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-3" date="1755518400">- test(SYSTEMD-INITRD): be more careful with `set -e` and subshells
- test: fixup NFS test.sh
  Resolves: RHEL-108215,RHEL-97473</changelog>
  <changelog author="EL Errata &lt;el-errata_ww@oracle.com&gt; - 107-3.0.1" date="1757073600">- Ship Oracle IMA certificate [Orabug: 35992862]
- Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
- Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
- network-legacy: Revert some shellcheck that breaks parse_option_121 in dhclient [Orabug: 33778173]
- Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
- Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
- Install missing 68-del-part-node.rules [Orabug: 32827579]
- Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
- dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
- Update list of necessary files after squashfs execution [Orabug: 29864620]
- Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
- Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
- Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
- Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
- 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
- Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828] (kevin.x.lyons@oracle.com)
- add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.2" date="1761912000">- Include correct modprobe into squashfs root [Orabug: 38559936]</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.3" date="1764676800">- Skip unneeded FIPS logic on UEK with special FIPS [Orabug: 38138800] [Orabug: 38709306]</changelog>
</package>
<package pkgid="d43af530ff6813f2d113df72d032e8b348afd37f" name="dracut-config-rescue" arch="aarch64">
  <version epoch="0" ver="107" rel="3.0.3.el10"/>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-1" date="1739793600">- build: upgrade to dracut 105
- fix(systemd-ask-password): do not half-install systemd-ask-password-wall
- fix(pcsc): add libpcsclite_real.so.*
- revert: "fix(rescue): make rescue always no-hostonly"
- fix(dracut-install): initize fts pointer
- feat: add openssl module
- build: make erofs the default requirement for squash subpackage
  Resolves: RHEL-65204,RHEL-68935,RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-2" date="1739793601">- fix(openssl): harden ossl build CFLAGS
  Related: RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-3" date="1739793602">- fix(ossl): copy executables for the test suite</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-4" date="1741262400">- fix(rescue): create hmac file for rescue kernel</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-1" date="1752753600">- Upgrade to dracut 107
  Resolves: RHEL-97473</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-2" date="1754568000">- fix: improve hostonly sloppy mode
- fix(dracut.sh): don't pass empty string as dir
- feat(systemd): drop unnecessary dependency on libgcrypt
- fix(kernel-modules-extra): remove stray  before /
- Revert "fix(base): do not require chroot inside initramfs"
- fix: let check_vol_slaves_all return 1 when checks on all slaves fail
- improvement(74nvmf): lookup required NIC kernel modules for NBFT interfaces
- fix(74nvmf): set root=nvmf
  Resolves: RHEL-104223,RHEL-93173,RHEL-95542,RHEL-95897</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-3" date="1755518400">- test(SYSTEMD-INITRD): be more careful with `set -e` and subshells
- test: fixup NFS test.sh
  Resolves: RHEL-108215,RHEL-97473</changelog>
  <changelog author="EL Errata &lt;el-errata_ww@oracle.com&gt; - 107-3.0.1" date="1757073600">- Ship Oracle IMA certificate [Orabug: 35992862]
- Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
- Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
- network-legacy: Revert some shellcheck that breaks parse_option_121 in dhclient [Orabug: 33778173]
- Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
- Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
- Install missing 68-del-part-node.rules [Orabug: 32827579]
- Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
- dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
- Update list of necessary files after squashfs execution [Orabug: 29864620]
- Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
- Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
- Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
- Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
- 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
- Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828] (kevin.x.lyons@oracle.com)
- add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.2" date="1761912000">- Include correct modprobe into squashfs root [Orabug: 38559936]</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.3" date="1764676800">- Skip unneeded FIPS logic on UEK with special FIPS [Orabug: 38138800] [Orabug: 38709306]</changelog>
</package>
<package pkgid="bc7ca45a58d3bef0dc121c796ca723df6f940f84" name="dracut-live" arch="aarch64">
  <version epoch="0" ver="107" rel="3.0.3.el10"/>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-1" date="1739793600">- build: upgrade to dracut 105
- fix(systemd-ask-password): do not half-install systemd-ask-password-wall
- fix(pcsc): add libpcsclite_real.so.*
- revert: "fix(rescue): make rescue always no-hostonly"
- fix(dracut-install): initize fts pointer
- feat: add openssl module
- build: make erofs the default requirement for squash subpackage
  Resolves: RHEL-65204,RHEL-68935,RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-2" date="1739793601">- fix(openssl): harden ossl build CFLAGS
  Related: RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-3" date="1739793602">- fix(ossl): copy executables for the test suite</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-4" date="1741262400">- fix(rescue): create hmac file for rescue kernel</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-1" date="1752753600">- Upgrade to dracut 107
  Resolves: RHEL-97473</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-2" date="1754568000">- fix: improve hostonly sloppy mode
- fix(dracut.sh): don't pass empty string as dir
- feat(systemd): drop unnecessary dependency on libgcrypt
- fix(kernel-modules-extra): remove stray  before /
- Revert "fix(base): do not require chroot inside initramfs"
- fix: let check_vol_slaves_all return 1 when checks on all slaves fail
- improvement(74nvmf): lookup required NIC kernel modules for NBFT interfaces
- fix(74nvmf): set root=nvmf
  Resolves: RHEL-104223,RHEL-93173,RHEL-95542,RHEL-95897</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-3" date="1755518400">- test(SYSTEMD-INITRD): be more careful with `set -e` and subshells
- test: fixup NFS test.sh
  Resolves: RHEL-108215,RHEL-97473</changelog>
  <changelog author="EL Errata &lt;el-errata_ww@oracle.com&gt; - 107-3.0.1" date="1757073600">- Ship Oracle IMA certificate [Orabug: 35992862]
- Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
- Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
- network-legacy: Revert some shellcheck that breaks parse_option_121 in dhclient [Orabug: 33778173]
- Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
- Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
- Install missing 68-del-part-node.rules [Orabug: 32827579]
- Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
- dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
- Update list of necessary files after squashfs execution [Orabug: 29864620]
- Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
- Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
- Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
- Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
- 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
- Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828] (kevin.x.lyons@oracle.com)
- add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.2" date="1761912000">- Include correct modprobe into squashfs root [Orabug: 38559936]</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.3" date="1764676800">- Skip unneeded FIPS logic on UEK with special FIPS [Orabug: 38138800] [Orabug: 38709306]</changelog>
</package>
<package pkgid="a2580450f6bf99d5ec9bb7d2df563596d340138e" name="dracut-network" arch="aarch64">
  <version epoch="0" ver="107" rel="3.0.3.el10"/>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-1" date="1739793600">- build: upgrade to dracut 105
- fix(systemd-ask-password): do not half-install systemd-ask-password-wall
- fix(pcsc): add libpcsclite_real.so.*
- revert: "fix(rescue): make rescue always no-hostonly"
- fix(dracut-install): initize fts pointer
- feat: add openssl module
- build: make erofs the default requirement for squash subpackage
  Resolves: RHEL-65204,RHEL-68935,RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-2" date="1739793601">- fix(openssl): harden ossl build CFLAGS
  Related: RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-3" date="1739793602">- fix(ossl): copy executables for the test suite</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-4" date="1741262400">- fix(rescue): create hmac file for rescue kernel</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-1" date="1752753600">- Upgrade to dracut 107
  Resolves: RHEL-97473</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-2" date="1754568000">- fix: improve hostonly sloppy mode
- fix(dracut.sh): don't pass empty string as dir
- feat(systemd): drop unnecessary dependency on libgcrypt
- fix(kernel-modules-extra): remove stray  before /
- Revert "fix(base): do not require chroot inside initramfs"
- fix: let check_vol_slaves_all return 1 when checks on all slaves fail
- improvement(74nvmf): lookup required NIC kernel modules for NBFT interfaces
- fix(74nvmf): set root=nvmf
  Resolves: RHEL-104223,RHEL-93173,RHEL-95542,RHEL-95897</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-3" date="1755518400">- test(SYSTEMD-INITRD): be more careful with `set -e` and subshells
- test: fixup NFS test.sh
  Resolves: RHEL-108215,RHEL-97473</changelog>
  <changelog author="EL Errata &lt;el-errata_ww@oracle.com&gt; - 107-3.0.1" date="1757073600">- Ship Oracle IMA certificate [Orabug: 35992862]
- Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
- Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
- network-legacy: Revert some shellcheck that breaks parse_option_121 in dhclient [Orabug: 33778173]
- Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
- Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
- Install missing 68-del-part-node.rules [Orabug: 32827579]
- Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
- dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
- Update list of necessary files after squashfs execution [Orabug: 29864620]
- Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
- Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
- Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
- Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
- 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
- Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828] (kevin.x.lyons@oracle.com)
- add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.2" date="1761912000">- Include correct modprobe into squashfs root [Orabug: 38559936]</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.3" date="1764676800">- Skip unneeded FIPS logic on UEK with special FIPS [Orabug: 38138800] [Orabug: 38709306]</changelog>
</package>
<package pkgid="e795b4a58745c8eefd9d68b10681715d1df29eb3" name="dracut-squash" arch="aarch64">
  <version epoch="0" ver="107" rel="3.0.3.el10"/>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-1" date="1739793600">- build: upgrade to dracut 105
- fix(systemd-ask-password): do not half-install systemd-ask-password-wall
- fix(pcsc): add libpcsclite_real.so.*
- revert: "fix(rescue): make rescue always no-hostonly"
- fix(dracut-install): initize fts pointer
- feat: add openssl module
- build: make erofs the default requirement for squash subpackage
  Resolves: RHEL-65204,RHEL-68935,RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-2" date="1739793601">- fix(openssl): harden ossl build CFLAGS
  Related: RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-3" date="1739793602">- fix(ossl): copy executables for the test suite</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-4" date="1741262400">- fix(rescue): create hmac file for rescue kernel</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-1" date="1752753600">- Upgrade to dracut 107
  Resolves: RHEL-97473</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-2" date="1754568000">- fix: improve hostonly sloppy mode
- fix(dracut.sh): don't pass empty string as dir
- feat(systemd): drop unnecessary dependency on libgcrypt
- fix(kernel-modules-extra): remove stray  before /
- Revert "fix(base): do not require chroot inside initramfs"
- fix: let check_vol_slaves_all return 1 when checks on all slaves fail
- improvement(74nvmf): lookup required NIC kernel modules for NBFT interfaces
- fix(74nvmf): set root=nvmf
  Resolves: RHEL-104223,RHEL-93173,RHEL-95542,RHEL-95897</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-3" date="1755518400">- test(SYSTEMD-INITRD): be more careful with `set -e` and subshells
- test: fixup NFS test.sh
  Resolves: RHEL-108215,RHEL-97473</changelog>
  <changelog author="EL Errata &lt;el-errata_ww@oracle.com&gt; - 107-3.0.1" date="1757073600">- Ship Oracle IMA certificate [Orabug: 35992862]
- Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
- Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
- network-legacy: Revert some shellcheck that breaks parse_option_121 in dhclient [Orabug: 33778173]
- Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
- Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
- Install missing 68-del-part-node.rules [Orabug: 32827579]
- Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
- dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
- Update list of necessary files after squashfs execution [Orabug: 29864620]
- Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
- Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
- Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
- Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
- 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
- Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828] (kevin.x.lyons@oracle.com)
- add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.2" date="1761912000">- Include correct modprobe into squashfs root [Orabug: 38559936]</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.3" date="1764676800">- Skip unneeded FIPS logic on UEK with special FIPS [Orabug: 38138800] [Orabug: 38709306]</changelog>
</package>
<package pkgid="0a7a6ffb163ed97e1afd25a26fbcbc788fd14d6a" name="dracut-tools" arch="aarch64">
  <version epoch="0" ver="107" rel="3.0.3.el10"/>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-1" date="1739793600">- build: upgrade to dracut 105
- fix(systemd-ask-password): do not half-install systemd-ask-password-wall
- fix(pcsc): add libpcsclite_real.so.*
- revert: "fix(rescue): make rescue always no-hostonly"
- fix(dracut-install): initize fts pointer
- feat: add openssl module
- build: make erofs the default requirement for squash subpackage
  Resolves: RHEL-65204,RHEL-68935,RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-2" date="1739793601">- fix(openssl): harden ossl build CFLAGS
  Related: RHEL-76323</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-3" date="1739793602">- fix(ossl): copy executables for the test suite</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 105-4" date="1741262400">- fix(rescue): create hmac file for rescue kernel</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-1" date="1752753600">- Upgrade to dracut 107
  Resolves: RHEL-97473</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-2" date="1754568000">- fix: improve hostonly sloppy mode
- fix(dracut.sh): don't pass empty string as dir
- feat(systemd): drop unnecessary dependency on libgcrypt
- fix(kernel-modules-extra): remove stray  before /
- Revert "fix(base): do not require chroot inside initramfs"
- fix: let check_vol_slaves_all return 1 when checks on all slaves fail
- improvement(74nvmf): lookup required NIC kernel modules for NBFT interfaces
- fix(74nvmf): set root=nvmf
  Resolves: RHEL-104223,RHEL-93173,RHEL-95542,RHEL-95897</changelog>
  <changelog author="Pavel Valena &lt;pvalena@redhat.com&gt; - 107-3" date="1755518400">- test(SYSTEMD-INITRD): be more careful with `set -e` and subshells
- test: fixup NFS test.sh
  Resolves: RHEL-108215,RHEL-97473</changelog>
  <changelog author="EL Errata &lt;el-errata_ww@oracle.com&gt; - 107-3.0.1" date="1757073600">- Ship Oracle IMA certificate [Orabug: 35992862]
- Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
- Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
- network-legacy: Revert some shellcheck that breaks parse_option_121 in dhclient [Orabug: 33778173]
- Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
- Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
- Install missing 68-del-part-node.rules [Orabug: 32827579]
- Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
- dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
- Update list of necessary files after squashfs execution [Orabug: 29864620]
- Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
- Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
- Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
- Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
- 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
- Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828] (kevin.x.lyons@oracle.com)
- add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.2" date="1761912000">- Include correct modprobe into squashfs root [Orabug: 38559936]</changelog>
  <changelog author="Alex Burmashev &lt;alexander.burmashev@oracle.com&gt; - 107-3.0.3" date="1764676800">- Skip unneeded FIPS logic on UEK with special FIPS [Orabug: 38138800] [Orabug: 38709306]</changelog>
</package>
<package pkgid="0a24b2b73fcc564623e255d5141c90a8e68f7f16" name="dtrace" arch="aarch64">
  <version epoch="0" ver="2.0.3" rel="1.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.11" date="1666958400">- Add initial support for USDT. (Nick Alcock, Kris Van Hees)
- Add support for aggregation keys. (Eugene Loh, Kris Van Hees)
- Add support for copyin(), copyinto(), and copyinstr().
- Add support for built-in variable args[] and sdt probe arg types.
- Fix arg handling for various probes. (Eugene Loh)
- Add basic support for setopt().
- Add -xlockmem, with useful error message. (Eugene Loh)
- Fix -xverbose, -xcpp, and -xctfpath
- Fix handling of multiple args after --. (Nick Alcock)
- Have the pid provider ignore compiler-generated internal function names.
- Fix various bugs with typecasting and internal integer storage. (Eugene Loh)
- Fix access to scalars in kernel space.
- Fix libproc search of rtld_global due to glibc changes. (Nick Alcock)
  [Orabug: 32856318]
- Truly decouple per-CPU BPF agg maps with a "map of maps."
- Unused dual aggregation copies (DT_AGG_NUM_COPIES) have been removed.
  (Eugene Loh)
- Various testsuite fixes and improvements. [Orabug: 34251899]
- Various code improvements. [Orabug: 34251899]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.11.1" date="1667908800">- Support both libfuse 2 and libfuse 3.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.12" date="1677499200">- Fix evaluation order of bcopy() arguments and lift non-alloca restriction
  on the source address. (Eugene Loh, Kris Van Hees)
- Implement actions: clear(), tracemem(). (Kris Van Hees, Eugene Loh)
- Implement subroutines: copyout(), copyinstr(). (Kris Van Hees, Eugene Loh)
- Implement options: switchrate, aggrate.
- Implement provider: cpc. (Eugene Loh)
- Implement provider: proc.
- Implement built-in variable: uregs. (Eugene Loh)
- Increase strtab maximum size.
- Support using indirect load instructions for pointers to alloca()'d and
  DTrace managed memory. (Kris Van Hees, Eugene Loh)
- Fix arg0 and arg1 for profile-* and tick-* probes. (Eugene Loh)
- Implement runtime bounds checking for scalar array access. (Eugene Loh)
- Updated manpage and moved to dtrace.8.
- Support arbitrary address pointers for basename(), dirname(), strchr(),
  strrchr(), and inet_ntoa(). (Eugene Loh) [Orabug: 34857846]
- Add runtime bounds checking for scalar array access. (Eugene Loh)
  [Orabug: 35045463]
- Various testsuite fixes and improvements. [Orabug: 34829509]
- Various code improvements. [Orabug: 34829509]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orbug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
</package>
<package pkgid="632a33821f8cc90958d188e4ee7f27f6a55fbd28" name="dtrace" arch="src">
  <version epoch="0" ver="2.0.3" rel="1.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.11" date="1666958400">- Add initial support for USDT. (Nick Alcock, Kris Van Hees)
- Add support for aggregation keys. (Eugene Loh, Kris Van Hees)
- Add support for copyin(), copyinto(), and copyinstr().
- Add support for built-in variable args[] and sdt probe arg types.
- Fix arg handling for various probes. (Eugene Loh)
- Add basic support for setopt().
- Add -xlockmem, with useful error message. (Eugene Loh)
- Fix -xverbose, -xcpp, and -xctfpath
- Fix handling of multiple args after --. (Nick Alcock)
- Have the pid provider ignore compiler-generated internal function names.
- Fix various bugs with typecasting and internal integer storage. (Eugene Loh)
- Fix access to scalars in kernel space.
- Fix libproc search of rtld_global due to glibc changes. (Nick Alcock)
  [Orabug: 32856318]
- Truly decouple per-CPU BPF agg maps with a "map of maps."
- Unused dual aggregation copies (DT_AGG_NUM_COPIES) have been removed.
  (Eugene Loh)
- Various testsuite fixes and improvements. [Orabug: 34251899]
- Various code improvements. [Orabug: 34251899]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.11.1" date="1667908800">- Support both libfuse 2 and libfuse 3.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.12" date="1677499200">- Fix evaluation order of bcopy() arguments and lift non-alloca restriction
  on the source address. (Eugene Loh, Kris Van Hees)
- Implement actions: clear(), tracemem(). (Kris Van Hees, Eugene Loh)
- Implement subroutines: copyout(), copyinstr(). (Kris Van Hees, Eugene Loh)
- Implement options: switchrate, aggrate.
- Implement provider: cpc. (Eugene Loh)
- Implement provider: proc.
- Implement built-in variable: uregs. (Eugene Loh)
- Increase strtab maximum size.
- Support using indirect load instructions for pointers to alloca()'d and
  DTrace managed memory. (Kris Van Hees, Eugene Loh)
- Fix arg0 and arg1 for profile-* and tick-* probes. (Eugene Loh)
- Implement runtime bounds checking for scalar array access. (Eugene Loh)
- Updated manpage and moved to dtrace.8.
- Support arbitrary address pointers for basename(), dirname(), strchr(),
  strrchr(), and inet_ntoa(). (Eugene Loh) [Orabug: 34857846]
- Add runtime bounds checking for scalar array access. (Eugene Loh)
  [Orabug: 35045463]
- Various testsuite fixes and improvements. [Orabug: 34829509]
- Various code improvements. [Orabug: 34829509]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orbug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
</package>
<package pkgid="560acc1c1ab3942772344ea69f676937261c5d90" name="dtrace" arch="aarch64">
  <version epoch="0" ver="2.0.4" rel="1.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.11.1" date="1667908800">- Support both libfuse 2 and libfuse 3.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.12" date="1677499200">- Fix evaluation order of bcopy() arguments and lift non-alloca restriction
  on the source address. (Eugene Loh, Kris Van Hees)
- Implement actions: clear(), tracemem(). (Kris Van Hees, Eugene Loh)
- Implement subroutines: copyout(), copyinstr(). (Kris Van Hees, Eugene Loh)
- Implement options: switchrate, aggrate.
- Implement provider: cpc. (Eugene Loh)
- Implement provider: proc.
- Implement built-in variable: uregs. (Eugene Loh)
- Increase strtab maximum size.
- Support using indirect load instructions for pointers to alloca()'d and
  DTrace managed memory. (Kris Van Hees, Eugene Loh)
- Fix arg0 and arg1 for profile-* and tick-* probes. (Eugene Loh)
- Implement runtime bounds checking for scalar array access. (Eugene Loh)
- Updated manpage and moved to dtrace.8.
- Support arbitrary address pointers for basename(), dirname(), strchr(),
  strrchr(), and inet_ntoa(). (Eugene Loh) [Orabug: 34857846]
- Add runtime bounds checking for scalar array access. (Eugene Loh)
  [Orabug: 35045463]
- Various testsuite fixes and improvements. [Orabug: 34829509]
- Various code improvements. [Orabug: 34829509]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orabug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
</package>
<package pkgid="aa2a4ac58c34f294261352d19a9655f28d9c2cd0" name="dtrace" arch="src">
  <version epoch="0" ver="2.0.4" rel="1.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.11.1" date="1667908800">- Support both libfuse 2 and libfuse 3.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.12" date="1677499200">- Fix evaluation order of bcopy() arguments and lift non-alloca restriction
  on the source address. (Eugene Loh, Kris Van Hees)
- Implement actions: clear(), tracemem(). (Kris Van Hees, Eugene Loh)
- Implement subroutines: copyout(), copyinstr(). (Kris Van Hees, Eugene Loh)
- Implement options: switchrate, aggrate.
- Implement provider: cpc. (Eugene Loh)
- Implement provider: proc.
- Implement built-in variable: uregs. (Eugene Loh)
- Increase strtab maximum size.
- Support using indirect load instructions for pointers to alloca()'d and
  DTrace managed memory. (Kris Van Hees, Eugene Loh)
- Fix arg0 and arg1 for profile-* and tick-* probes. (Eugene Loh)
- Implement runtime bounds checking for scalar array access. (Eugene Loh)
- Updated manpage and moved to dtrace.8.
- Support arbitrary address pointers for basename(), dirname(), strchr(),
  strrchr(), and inet_ntoa(). (Eugene Loh) [Orabug: 34857846]
- Add runtime bounds checking for scalar array access. (Eugene Loh)
  [Orabug: 35045463]
- Various testsuite fixes and improvements. [Orabug: 34829509]
- Various code improvements. [Orabug: 34829509]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orabug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
</package>
<package pkgid="3ce4abe2d9571fb8c0d07e10ff9caf996685c36a" name="dtrace" arch="aarch64">
  <version epoch="0" ver="2.0.5" rel="2.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.12" date="1677499200">- Fix evaluation order of bcopy() arguments and lift non-alloca restriction
  on the source address. (Eugene Loh, Kris Van Hees)
- Implement actions: clear(), tracemem(). (Kris Van Hees, Eugene Loh)
- Implement subroutines: copyout(), copyinstr(). (Kris Van Hees, Eugene Loh)
- Implement options: switchrate, aggrate.
- Implement provider: cpc. (Eugene Loh)
- Implement provider: proc.
- Implement built-in variable: uregs. (Eugene Loh)
- Increase strtab maximum size.
- Support using indirect load instructions for pointers to alloca()'d and
  DTrace managed memory. (Kris Van Hees, Eugene Loh)
- Fix arg0 and arg1 for profile-* and tick-* probes. (Eugene Loh)
- Implement runtime bounds checking for scalar array access. (Eugene Loh)
- Updated manpage and moved to dtrace.8.
- Support arbitrary address pointers for basename(), dirname(), strchr(),
  strrchr(), and inet_ntoa(). (Eugene Loh) [Orabug: 34857846]
- Add runtime bounds checking for scalar array access. (Eugene Loh)
  [Orabug: 35045463]
- Various testsuite fixes and improvements. [Orabug: 34829509]
- Various code improvements. [Orabug: 34829509]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orabug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.5-1" date="1770206400">- Implement PID-specific uprobes.  (Kris Van Hees)
- Allocate the buffers BPF map to fit highest CPU id.  (Kris Van Hees)
- Fix argument handling for multi-location user probes.
  (Kris Van Hees) [Orabug: 38922360]
- Change the "stack skip" to 3 for fbt (fprobe) and rawtp providers.
  [Orabug: 38776929]
- Fix prvname so that both rawfbt and fbt probes are seen.
  [Orabug: 38842114]
- Do not convert "__" to "-" for stapsdt provider names.
- Fix printf formatting with non-monetary grouping chars.
  [Orabug: 30430270]
- Discontinue -xversion=V as an option.  (Kris Van Hees) [Orabug: 38615307]
- Add the DTrace Tutorial to the git repo and install package.
- Add missing documentation:  trunc(), stapsdt, usdt.h include path.
- Update LLM context files to forbid "if" statements.
- Test suite weakly pulls in kernel-uek-tools to get perf.  (Nick Alcock)
  [Orabug: 38064413]</changelog>
</package>
<package pkgid="41421ad24afffd56e5a8560486b1f385e374a71f" name="dtrace" arch="src">
  <version epoch="0" ver="2.0.5" rel="2.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.12" date="1677499200">- Fix evaluation order of bcopy() arguments and lift non-alloca restriction
  on the source address. (Eugene Loh, Kris Van Hees)
- Implement actions: clear(), tracemem(). (Kris Van Hees, Eugene Loh)
- Implement subroutines: copyout(), copyinstr(). (Kris Van Hees, Eugene Loh)
- Implement options: switchrate, aggrate.
- Implement provider: cpc. (Eugene Loh)
- Implement provider: proc.
- Implement built-in variable: uregs. (Eugene Loh)
- Increase strtab maximum size.
- Support using indirect load instructions for pointers to alloca()'d and
  DTrace managed memory. (Kris Van Hees, Eugene Loh)
- Fix arg0 and arg1 for profile-* and tick-* probes. (Eugene Loh)
- Implement runtime bounds checking for scalar array access. (Eugene Loh)
- Updated manpage and moved to dtrace.8.
- Support arbitrary address pointers for basename(), dirname(), strchr(),
  strrchr(), and inet_ntoa(). (Eugene Loh) [Orabug: 34857846]
- Add runtime bounds checking for scalar array access. (Eugene Loh)
  [Orabug: 35045463]
- Various testsuite fixes and improvements. [Orabug: 34829509]
- Various code improvements. [Orabug: 34829509]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orabug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.5-1" date="1770206400">- Implement PID-specific uprobes.  (Kris Van Hees)
- Allocate the buffers BPF map to fit highest CPU id.  (Kris Van Hees)
- Fix argument handling for multi-location user probes.
  (Kris Van Hees) [Orabug: 38922360]
- Change the "stack skip" to 3 for fbt (fprobe) and rawtp providers.
  [Orabug: 38776929]
- Fix prvname so that both rawfbt and fbt probes are seen.
  [Orabug: 38842114]
- Do not convert "__" to "-" for stapsdt provider names.
- Fix printf formatting with non-monetary grouping chars.
  [Orabug: 30430270]
- Discontinue -xversion=V as an option.  (Kris Van Hees) [Orabug: 38615307]
- Add the DTrace Tutorial to the git repo and install package.
- Add missing documentation:  trunc(), stapsdt, usdt.h include path.
- Update LLM context files to forbid "if" statements.
- Test suite weakly pulls in kernel-uek-tools to get perf.  (Nick Alcock)
  [Orabug: 38064413]</changelog>
</package>
<package pkgid="23d17ad0aba59fb1817d8dc2daa0b57f3c53e5e1" name="dtrace" arch="aarch64">
  <version epoch="0" ver="2.0.6" rel="1.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orabug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.5-1" date="1770206400">- Implement PID-specific uprobes.  (Kris Van Hees)
- Allocate the buffers BPF map to fit highest CPU id.  (Kris Van Hees)
- Fix argument handling for multi-location user probes.
  (Kris Van Hees) [Orabug: 38922360]
- Change the "stack skip" to 3 for fbt (fprobe) and rawtp providers.
  [Orabug: 38776929]
- Fix prvname so that both rawfbt and fbt probes are seen.
  [Orabug: 38842114]
- Do not convert "__" to "-" for stapsdt provider names.
- Fix printf formatting with non-monetary grouping chars.
  [Orabug: 30430270]
- Discontinue -xversion=V as an option.  (Kris Van Hees) [Orabug: 38615307]
- Add the DTrace Tutorial to the git repo and install package.
- Add missing documentation:  trunc(), stapsdt, usdt.h include path.
- Update LLM context files to forbid "if" statements.
- Test suite weakly pulls in kernel-uek-tools to get perf.  (Nick Alcock)
  [Orabug: 38064413]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.6-1" date="1773057600">- Fix dtprobed unsafe probe description handling (CVE-2026-21991).
  [Orabug: 39054018]</changelog>
</package>
<package pkgid="2af12ceae3a81c041bf4e50a0f53768aea7416c8" name="dtrace" arch="src">
  <version epoch="0" ver="2.0.6" rel="1.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orabug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.5-1" date="1770206400">- Implement PID-specific uprobes.  (Kris Van Hees)
- Allocate the buffers BPF map to fit highest CPU id.  (Kris Van Hees)
- Fix argument handling for multi-location user probes.
  (Kris Van Hees) [Orabug: 38922360]
- Change the "stack skip" to 3 for fbt (fprobe) and rawtp providers.
  [Orabug: 38776929]
- Fix prvname so that both rawfbt and fbt probes are seen.
  [Orabug: 38842114]
- Do not convert "__" to "-" for stapsdt provider names.
- Fix printf formatting with non-monetary grouping chars.
  [Orabug: 30430270]
- Discontinue -xversion=V as an option.  (Kris Van Hees) [Orabug: 38615307]
- Add the DTrace Tutorial to the git repo and install package.
- Add missing documentation:  trunc(), stapsdt, usdt.h include path.
- Update LLM context files to forbid "if" statements.
- Test suite weakly pulls in kernel-uek-tools to get perf.  (Nick Alcock)
  [Orabug: 38064413]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.6-1" date="1773057600">- Fix dtprobed unsafe probe description handling (CVE-2026-21991).
  [Orabug: 39054018]</changelog>
</package>
<package pkgid="4b105eebd0902a9bee8e304fae7a238355c15e93" name="dtrace" arch="aarch64">
  <version epoch="0" ver="2.0.7" rel="4.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.5-1" date="1770206400">- Implement PID-specific uprobes.  (Kris Van Hees)
- Allocate the buffers BPF map to fit highest CPU id.  (Kris Van Hees)
- Fix argument handling for multi-location user probes.
  (Kris Van Hees) [Orabug: 38922360]
- Change the "stack skip" to 3 for fbt (fprobe) and rawtp providers.
  [Orabug: 38776929]
- Fix prvname so that both rawfbt and fbt probes are seen.
  [Orabug: 38842114]
- Do not convert "__" to "-" for stapsdt provider names.
- Fix printf formatting with non-monetary grouping chars.
  [Orabug: 30430270]
- Discontinue -xversion=V as an option.  (Kris Van Hees) [Orabug: 38615307]
- Add the DTrace Tutorial to the git repo and install package.
- Add missing documentation:  trunc(), stapsdt, usdt.h include path.
- Update LLM context files to forbid "if" statements.
- Test suite weakly pulls in kernel-uek-tools to get perf.  (Nick Alcock)
  [Orabug: 38064413]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.6-1" date="1773057600">- Fix dtprobed unsafe probe description handling (CVE-2026-21991).
  [Orabug: 39054018]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.7-4" date="1777464000">- Prevent out-of-buonds memory access during object symbol table construction
  (CVE-2026-35233).  [Orabug: 39121881]
- Prevent divide-by-zero (FPE trap) if section header data is corrupted.
  (CVE-2026-21996).  [Orabug: 39121874]
- Ensure safety checks are performed on program header data from ELF objects.
- Ensure that the data of string table sections is proper terminated.
- Ensure that the symbol table references a valid string table.</changelog>
</package>
<package pkgid="25558573a92ad54ada8826c8e520f3db93e98aeb" name="dtrace" arch="src">
  <version epoch="0" ver="2.0.7" rel="4.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.5-1" date="1770206400">- Implement PID-specific uprobes.  (Kris Van Hees)
- Allocate the buffers BPF map to fit highest CPU id.  (Kris Van Hees)
- Fix argument handling for multi-location user probes.
  (Kris Van Hees) [Orabug: 38922360]
- Change the "stack skip" to 3 for fbt (fprobe) and rawtp providers.
  [Orabug: 38776929]
- Fix prvname so that both rawfbt and fbt probes are seen.
  [Orabug: 38842114]
- Do not convert "__" to "-" for stapsdt provider names.
- Fix printf formatting with non-monetary grouping chars.
  [Orabug: 30430270]
- Discontinue -xversion=V as an option.  (Kris Van Hees) [Orabug: 38615307]
- Add the DTrace Tutorial to the git repo and install package.
- Add missing documentation:  trunc(), stapsdt, usdt.h include path.
- Update LLM context files to forbid "if" statements.
- Test suite weakly pulls in kernel-uek-tools to get perf.  (Nick Alcock)
  [Orabug: 38064413]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.6-1" date="1773057600">- Fix dtprobed unsafe probe description handling (CVE-2026-21991).
  [Orabug: 39054018]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.7-4" date="1777464000">- Prevent out-of-buonds memory access during object symbol table construction
  (CVE-2026-35233).  [Orabug: 39121881]
- Prevent divide-by-zero (FPE trap) if section header data is corrupted.
  (CVE-2026-21996).  [Orabug: 39121874]
- Ensure safety checks are performed on program header data from ELF objects.
- Ensure that the data of string table sections is proper terminated.
- Ensure that the symbol table references a valid string table.</changelog>
</package>
<package pkgid="9d054ac9a68e9718273e415e3345971e8c3cab7a" name="dtrace-devel" arch="aarch64">
  <version epoch="0" ver="2.0.3" rel="1.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.11" date="1666958400">- Add initial support for USDT. (Nick Alcock, Kris Van Hees)
- Add support for aggregation keys. (Eugene Loh, Kris Van Hees)
- Add support for copyin(), copyinto(), and copyinstr().
- Add support for built-in variable args[] and sdt probe arg types.
- Fix arg handling for various probes. (Eugene Loh)
- Add basic support for setopt().
- Add -xlockmem, with useful error message. (Eugene Loh)
- Fix -xverbose, -xcpp, and -xctfpath
- Fix handling of multiple args after --. (Nick Alcock)
- Have the pid provider ignore compiler-generated internal function names.
- Fix various bugs with typecasting and internal integer storage. (Eugene Loh)
- Fix access to scalars in kernel space.
- Fix libproc search of rtld_global due to glibc changes. (Nick Alcock)
  [Orabug: 32856318]
- Truly decouple per-CPU BPF agg maps with a "map of maps."
- Unused dual aggregation copies (DT_AGG_NUM_COPIES) have been removed.
  (Eugene Loh)
- Various testsuite fixes and improvements. [Orabug: 34251899]
- Various code improvements. [Orabug: 34251899]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.11.1" date="1667908800">- Support both libfuse 2 and libfuse 3.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.12" date="1677499200">- Fix evaluation order of bcopy() arguments and lift non-alloca restriction
  on the source address. (Eugene Loh, Kris Van Hees)
- Implement actions: clear(), tracemem(). (Kris Van Hees, Eugene Loh)
- Implement subroutines: copyout(), copyinstr(). (Kris Van Hees, Eugene Loh)
- Implement options: switchrate, aggrate.
- Implement provider: cpc. (Eugene Loh)
- Implement provider: proc.
- Implement built-in variable: uregs. (Eugene Loh)
- Increase strtab maximum size.
- Support using indirect load instructions for pointers to alloca()'d and
  DTrace managed memory. (Kris Van Hees, Eugene Loh)
- Fix arg0 and arg1 for profile-* and tick-* probes. (Eugene Loh)
- Implement runtime bounds checking for scalar array access. (Eugene Loh)
- Updated manpage and moved to dtrace.8.
- Support arbitrary address pointers for basename(), dirname(), strchr(),
  strrchr(), and inet_ntoa(). (Eugene Loh) [Orabug: 34857846]
- Add runtime bounds checking for scalar array access. (Eugene Loh)
  [Orabug: 35045463]
- Various testsuite fixes and improvements. [Orabug: 34829509]
- Various code improvements. [Orabug: 34829509]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orbug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
</package>
<package pkgid="cda1670fee5ab3fe756be33bf9e94b239a7c9678" name="dtrace-devel" arch="aarch64">
  <version epoch="0" ver="2.0.4" rel="1.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.11.1" date="1667908800">- Support both libfuse 2 and libfuse 3.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.12" date="1677499200">- Fix evaluation order of bcopy() arguments and lift non-alloca restriction
  on the source address. (Eugene Loh, Kris Van Hees)
- Implement actions: clear(), tracemem(). (Kris Van Hees, Eugene Loh)
- Implement subroutines: copyout(), copyinstr(). (Kris Van Hees, Eugene Loh)
- Implement options: switchrate, aggrate.
- Implement provider: cpc. (Eugene Loh)
- Implement provider: proc.
- Implement built-in variable: uregs. (Eugene Loh)
- Increase strtab maximum size.
- Support using indirect load instructions for pointers to alloca()'d and
  DTrace managed memory. (Kris Van Hees, Eugene Loh)
- Fix arg0 and arg1 for profile-* and tick-* probes. (Eugene Loh)
- Implement runtime bounds checking for scalar array access. (Eugene Loh)
- Updated manpage and moved to dtrace.8.
- Support arbitrary address pointers for basename(), dirname(), strchr(),
  strrchr(), and inet_ntoa(). (Eugene Loh) [Orabug: 34857846]
- Add runtime bounds checking for scalar array access. (Eugene Loh)
  [Orabug: 35045463]
- Various testsuite fixes and improvements. [Orabug: 34829509]
- Various code improvements. [Orabug: 34829509]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orabug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
</package>
<package pkgid="8639d2175374bc277ab6a62ce6d0fdb319c21a3c" name="dtrace-devel" arch="aarch64">
  <version epoch="0" ver="2.0.5" rel="2.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.12" date="1677499200">- Fix evaluation order of bcopy() arguments and lift non-alloca restriction
  on the source address. (Eugene Loh, Kris Van Hees)
- Implement actions: clear(), tracemem(). (Kris Van Hees, Eugene Loh)
- Implement subroutines: copyout(), copyinstr(). (Kris Van Hees, Eugene Loh)
- Implement options: switchrate, aggrate.
- Implement provider: cpc. (Eugene Loh)
- Implement provider: proc.
- Implement built-in variable: uregs. (Eugene Loh)
- Increase strtab maximum size.
- Support using indirect load instructions for pointers to alloca()'d and
  DTrace managed memory. (Kris Van Hees, Eugene Loh)
- Fix arg0 and arg1 for profile-* and tick-* probes. (Eugene Loh)
- Implement runtime bounds checking for scalar array access. (Eugene Loh)
- Updated manpage and moved to dtrace.8.
- Support arbitrary address pointers for basename(), dirname(), strchr(),
  strrchr(), and inet_ntoa(). (Eugene Loh) [Orabug: 34857846]
- Add runtime bounds checking for scalar array access. (Eugene Loh)
  [Orabug: 35045463]
- Various testsuite fixes and improvements. [Orabug: 34829509]
- Various code improvements. [Orabug: 34829509]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orabug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.5-1" date="1770206400">- Implement PID-specific uprobes.  (Kris Van Hees)
- Allocate the buffers BPF map to fit highest CPU id.  (Kris Van Hees)
- Fix argument handling for multi-location user probes.
  (Kris Van Hees) [Orabug: 38922360]
- Change the "stack skip" to 3 for fbt (fprobe) and rawtp providers.
  [Orabug: 38776929]
- Fix prvname so that both rawfbt and fbt probes are seen.
  [Orabug: 38842114]
- Do not convert "__" to "-" for stapsdt provider names.
- Fix printf formatting with non-monetary grouping chars.
  [Orabug: 30430270]
- Discontinue -xversion=V as an option.  (Kris Van Hees) [Orabug: 38615307]
- Add the DTrace Tutorial to the git repo and install package.
- Add missing documentation:  trunc(), stapsdt, usdt.h include path.
- Update LLM context files to forbid "if" statements.
- Test suite weakly pulls in kernel-uek-tools to get perf.  (Nick Alcock)
  [Orabug: 38064413]</changelog>
</package>
<package pkgid="ac367871284930745d67529a0ff853d87cd34ca2" name="dtrace-devel" arch="aarch64">
  <version epoch="0" ver="2.0.6" rel="1.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orabug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.5-1" date="1770206400">- Implement PID-specific uprobes.  (Kris Van Hees)
- Allocate the buffers BPF map to fit highest CPU id.  (Kris Van Hees)
- Fix argument handling for multi-location user probes.
  (Kris Van Hees) [Orabug: 38922360]
- Change the "stack skip" to 3 for fbt (fprobe) and rawtp providers.
  [Orabug: 38776929]
- Fix prvname so that both rawfbt and fbt probes are seen.
  [Orabug: 38842114]
- Do not convert "__" to "-" for stapsdt provider names.
- Fix printf formatting with non-monetary grouping chars.
  [Orabug: 30430270]
- Discontinue -xversion=V as an option.  (Kris Van Hees) [Orabug: 38615307]
- Add the DTrace Tutorial to the git repo and install package.
- Add missing documentation:  trunc(), stapsdt, usdt.h include path.
- Update LLM context files to forbid "if" statements.
- Test suite weakly pulls in kernel-uek-tools to get perf.  (Nick Alcock)
  [Orabug: 38064413]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.6-1" date="1773057600">- Fix dtprobed unsafe probe description handling (CVE-2026-21991).
  [Orabug: 39054018]</changelog>
</package>
<package pkgid="26fe1b3119a530f441e75a5155433bc98fcca36f" name="dtrace-devel" arch="aarch64">
  <version epoch="0" ver="2.0.7" rel="4.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.5-1" date="1770206400">- Implement PID-specific uprobes.  (Kris Van Hees)
- Allocate the buffers BPF map to fit highest CPU id.  (Kris Van Hees)
- Fix argument handling for multi-location user probes.
  (Kris Van Hees) [Orabug: 38922360]
- Change the "stack skip" to 3 for fbt (fprobe) and rawtp providers.
  [Orabug: 38776929]
- Fix prvname so that both rawfbt and fbt probes are seen.
  [Orabug: 38842114]
- Do not convert "__" to "-" for stapsdt provider names.
- Fix printf formatting with non-monetary grouping chars.
  [Orabug: 30430270]
- Discontinue -xversion=V as an option.  (Kris Van Hees) [Orabug: 38615307]
- Add the DTrace Tutorial to the git repo and install package.
- Add missing documentation:  trunc(), stapsdt, usdt.h include path.
- Update LLM context files to forbid "if" statements.
- Test suite weakly pulls in kernel-uek-tools to get perf.  (Nick Alcock)
  [Orabug: 38064413]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.6-1" date="1773057600">- Fix dtprobed unsafe probe description handling (CVE-2026-21991).
  [Orabug: 39054018]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.7-4" date="1777464000">- Prevent out-of-buonds memory access during object symbol table construction
  (CVE-2026-35233).  [Orabug: 39121881]
- Prevent divide-by-zero (FPE trap) if section header data is corrupted.
  (CVE-2026-21996).  [Orabug: 39121874]
- Ensure safety checks are performed on program header data from ELF objects.
- Ensure that the data of string table sections is proper terminated.
- Ensure that the symbol table references a valid string table.</changelog>
</package>
<package pkgid="2a4abdc2d4b1956610580c8d22892959da29799f" name="dtrace-testsuite" arch="aarch64">
  <version epoch="0" ver="2.0.3" rel="1.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.11" date="1666958400">- Add initial support for USDT. (Nick Alcock, Kris Van Hees)
- Add support for aggregation keys. (Eugene Loh, Kris Van Hees)
- Add support for copyin(), copyinto(), and copyinstr().
- Add support for built-in variable args[] and sdt probe arg types.
- Fix arg handling for various probes. (Eugene Loh)
- Add basic support for setopt().
- Add -xlockmem, with useful error message. (Eugene Loh)
- Fix -xverbose, -xcpp, and -xctfpath
- Fix handling of multiple args after --. (Nick Alcock)
- Have the pid provider ignore compiler-generated internal function names.
- Fix various bugs with typecasting and internal integer storage. (Eugene Loh)
- Fix access to scalars in kernel space.
- Fix libproc search of rtld_global due to glibc changes. (Nick Alcock)
  [Orabug: 32856318]
- Truly decouple per-CPU BPF agg maps with a "map of maps."
- Unused dual aggregation copies (DT_AGG_NUM_COPIES) have been removed.
  (Eugene Loh)
- Various testsuite fixes and improvements. [Orabug: 34251899]
- Various code improvements. [Orabug: 34251899]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.11.1" date="1667908800">- Support both libfuse 2 and libfuse 3.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.12" date="1677499200">- Fix evaluation order of bcopy() arguments and lift non-alloca restriction
  on the source address. (Eugene Loh, Kris Van Hees)
- Implement actions: clear(), tracemem(). (Kris Van Hees, Eugene Loh)
- Implement subroutines: copyout(), copyinstr(). (Kris Van Hees, Eugene Loh)
- Implement options: switchrate, aggrate.
- Implement provider: cpc. (Eugene Loh)
- Implement provider: proc.
- Implement built-in variable: uregs. (Eugene Loh)
- Increase strtab maximum size.
- Support using indirect load instructions for pointers to alloca()'d and
  DTrace managed memory. (Kris Van Hees, Eugene Loh)
- Fix arg0 and arg1 for profile-* and tick-* probes. (Eugene Loh)
- Implement runtime bounds checking for scalar array access. (Eugene Loh)
- Updated manpage and moved to dtrace.8.
- Support arbitrary address pointers for basename(), dirname(), strchr(),
  strrchr(), and inet_ntoa(). (Eugene Loh) [Orabug: 34857846]
- Add runtime bounds checking for scalar array access. (Eugene Loh)
  [Orabug: 35045463]
- Various testsuite fixes and improvements. [Orabug: 34829509]
- Various code improvements. [Orabug: 34829509]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orbug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
</package>
<package pkgid="c813f21ba7ae5ef430fb70e9e660cc42f3cd5f77" name="dtrace-testsuite" arch="aarch64">
  <version epoch="0" ver="2.0.4" rel="1.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.11.1" date="1667908800">- Support both libfuse 2 and libfuse 3.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.12" date="1677499200">- Fix evaluation order of bcopy() arguments and lift non-alloca restriction
  on the source address. (Eugene Loh, Kris Van Hees)
- Implement actions: clear(), tracemem(). (Kris Van Hees, Eugene Loh)
- Implement subroutines: copyout(), copyinstr(). (Kris Van Hees, Eugene Loh)
- Implement options: switchrate, aggrate.
- Implement provider: cpc. (Eugene Loh)
- Implement provider: proc.
- Implement built-in variable: uregs. (Eugene Loh)
- Increase strtab maximum size.
- Support using indirect load instructions for pointers to alloca()'d and
  DTrace managed memory. (Kris Van Hees, Eugene Loh)
- Fix arg0 and arg1 for profile-* and tick-* probes. (Eugene Loh)
- Implement runtime bounds checking for scalar array access. (Eugene Loh)
- Updated manpage and moved to dtrace.8.
- Support arbitrary address pointers for basename(), dirname(), strchr(),
  strrchr(), and inet_ntoa(). (Eugene Loh) [Orabug: 34857846]
- Add runtime bounds checking for scalar array access. (Eugene Loh)
  [Orabug: 35045463]
- Various testsuite fixes and improvements. [Orabug: 34829509]
- Various code improvements. [Orabug: 34829509]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orabug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
</package>
<package pkgid="572a7430e8ff6896eee91269bd97651971e48e1a" name="dtrace-testsuite" arch="aarch64">
  <version epoch="0" ver="2.0.5" rel="2.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.12" date="1677499200">- Fix evaluation order of bcopy() arguments and lift non-alloca restriction
  on the source address. (Eugene Loh, Kris Van Hees)
- Implement actions: clear(), tracemem(). (Kris Van Hees, Eugene Loh)
- Implement subroutines: copyout(), copyinstr(). (Kris Van Hees, Eugene Loh)
- Implement options: switchrate, aggrate.
- Implement provider: cpc. (Eugene Loh)
- Implement provider: proc.
- Implement built-in variable: uregs. (Eugene Loh)
- Increase strtab maximum size.
- Support using indirect load instructions for pointers to alloca()'d and
  DTrace managed memory. (Kris Van Hees, Eugene Loh)
- Fix arg0 and arg1 for profile-* and tick-* probes. (Eugene Loh)
- Implement runtime bounds checking for scalar array access. (Eugene Loh)
- Updated manpage and moved to dtrace.8.
- Support arbitrary address pointers for basename(), dirname(), strchr(),
  strrchr(), and inet_ntoa(). (Eugene Loh) [Orabug: 34857846]
- Add runtime bounds checking for scalar array access. (Eugene Loh)
  [Orabug: 35045463]
- Various testsuite fixes and improvements. [Orabug: 34829509]
- Various code improvements. [Orabug: 34829509]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orabug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.5-1" date="1770206400">- Implement PID-specific uprobes.  (Kris Van Hees)
- Allocate the buffers BPF map to fit highest CPU id.  (Kris Van Hees)
- Fix argument handling for multi-location user probes.
  (Kris Van Hees) [Orabug: 38922360]
- Change the "stack skip" to 3 for fbt (fprobe) and rawtp providers.
  [Orabug: 38776929]
- Fix prvname so that both rawfbt and fbt probes are seen.
  [Orabug: 38842114]
- Do not convert "__" to "-" for stapsdt provider names.
- Fix printf formatting with non-monetary grouping chars.
  [Orabug: 30430270]
- Discontinue -xversion=V as an option.  (Kris Van Hees) [Orabug: 38615307]
- Add the DTrace Tutorial to the git repo and install package.
- Add missing documentation:  trunc(), stapsdt, usdt.h include path.
- Update LLM context files to forbid "if" statements.
- Test suite weakly pulls in kernel-uek-tools to get perf.  (Nick Alcock)
  [Orabug: 38064413]</changelog>
</package>
<package pkgid="57214e4a6b07db580ba1404aa2827d3668edb5d0" name="dtrace-testsuite" arch="aarch64">
  <version epoch="0" ver="2.0.6" rel="1.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13" date="1685102400">- Full support for is-enabled USDT probes. (Nick Alcock)
- Report error on programs that exceed aggsize or dynvarsize.
- Support for drop counters for principal, speculation, and aggregation buffers
  and for dynamic variables.
- Implement probe: proc:::signal-clear.
- Implement provider: sched (partial implementation).
- Implement provider: lockstat (for kernels &gt;= 5.10.0 and UEK6 with fix).
- Support NULL strings. (Eugene Loh)
- Support uregs[] on older kernels. (Eugene Loh)
- New option: lonknommap. (Nick Alcock)
- Support for USDT probes in programs in different fs namespaces. (Nick Alcock)
- Support for USDT probes in non-PIE executables. (Nick Alcock)
- Fix dtprobed to support DOF that exceeds 64KiB. (Nick Alcock)
  [Orabug: 35411920]
- Do not modify input files with dtrace -G if unchanged. (Steven Sistare)
  [Orabug: 35417184]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees) [Orabug: 35435195]
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 35435195]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.5-1" date="1770206400">- Implement PID-specific uprobes.  (Kris Van Hees)
- Allocate the buffers BPF map to fit highest CPU id.  (Kris Van Hees)
- Fix argument handling for multi-location user probes.
  (Kris Van Hees) [Orabug: 38922360]
- Change the "stack skip" to 3 for fbt (fprobe) and rawtp providers.
  [Orabug: 38776929]
- Fix prvname so that both rawfbt and fbt probes are seen.
  [Orabug: 38842114]
- Do not convert "__" to "-" for stapsdt provider names.
- Fix printf formatting with non-monetary grouping chars.
  [Orabug: 30430270]
- Discontinue -xversion=V as an option.  (Kris Van Hees) [Orabug: 38615307]
- Add the DTrace Tutorial to the git repo and install package.
- Add missing documentation:  trunc(), stapsdt, usdt.h include path.
- Update LLM context files to forbid "if" statements.
- Test suite weakly pulls in kernel-uek-tools to get perf.  (Nick Alcock)
  [Orabug: 38064413]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.6-1" date="1773057600">- Fix dtprobed unsafe probe description handling (CVE-2026-21991).
  [Orabug: 39054018]</changelog>
</package>
<package pkgid="b06b680996bffe34a3b80a0f90b4d43653bda94c" name="dtrace-testsuite" arch="aarch64">
  <version epoch="0" ver="2.0.7" rel="4.el10"/>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.1" date="1686139200">- Restart dtprobed when upgrading DTrace.
- Report and clean up orphaned tracing events after each test.</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.13.2" date="1699531200">- Support using DTrace with upstream kernels.
- Implement provider: ip.
- Implement actions: trunc(), pcap().
- Implement subroutines: inet_ntoa6().
- Implement subroutines: inet_ntop(). (Eugene Loh)
- Support modules.builtin.ranges for builtin module-symbol association.
- Provide a BTF-to-CTF convertor to provide (limited) kernel type information
  when CTF is not available.
- Remove dependency on waitfd(). (Nick Alcock)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements. (Nick Alcock, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.0-1.14" date="1709640000">- Implement provider: io.  (Eugene Loh, Kris Van Hees)
- Implement actions: print().  (Alan Maguire)
- Implement subroutines: link_ntop(), cleanpath().  (Eugene Loh)
- Implement options: -xcpu, -xaggpercpu.  (Eugene Loh)
- Improve providers: pid (offset-based probes) and rawtp (arg info).
- Improve options: -xlockmem (improve default).  (Eugene Loh)
- Ensure USDT probes can survive dtprobed restarts.  (Nick Alcock)
- Improve USDT probe creation/deletion.  (Nick Alcock)
- Improve support for DTrace with upstream kernels.  (Nick Alcock)
- Improve support for compiling DTrace in older environments.  (Kris Van Hees)
- Add support for aggregations of stacks.  (Eugene Loh)
- Improve lexer parsing (top-level wildcard ambiguities and `numerals).
  (Nick Alcock)
- Fix END probe execution with multiple tracers.  (Nick Alcock)
- Preemptive BPF program execution for DTrace probes is not allowed.
- Buffer overrun fix for systems with non-sequential online CPU ids.
  (Kris Van Hees, Nick Alcock) [Orabug: 36356681]
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 36329725]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.1-1" date="1714996800">- Implement FBT probes with fentry/fexit tracepoints
- Provide argument info for FBT probes.
- Provide pre-generated translator files sets. [Orabug: 36504847]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.2-1" date="1731326400">- Translators to support kernels 6.10 and later.
- FBT return probe argument support.
- The print() action is augmented with type information.  (Alan Maguire)
- Support to discover and trace USDT probes after a tracing session has
  started.  (Eugene Loh, Nick Alcock)
- USDT probe argument support (translated types, mapping).  (Nick Alcock)
- Installation locations are now configurable.  (Nick Alcock)
- Valgrind is no longer a required build dependency.  (Nick Alcock)
- Self-grabs have been improved.  (Nick Alcock)
- New provider: rawfbt.  (Kris Van Hees)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)
- Various code improvements.  (Nick Alcock, Eugene Loh, Kris Van Hees)
  [Orabug: 37274251]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.3-1" date="1749556800">- This is only released on OL10.
- Redesigned USDT support to work for LTO compilations.  [Orabug: 38011704]
- New builtin variable: execargs.
- Offset probes in pid provider.  (Eugene Loh)
- Various bug fixes.  (Nick Alcock, Eugene Loh, Kris Van Hees)
- Various testsuite fixes and improvements.
  (Nick Alcock, Sam James, Eugene Loh, Kris Van Hees)</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.4-1" date="1761307200">- TCP, UDP, and stapsdt providers implemented.  (Alan Maguire)
- New learning materials:  the User's Guide in Markdown format,
  example scripts, and a context file for LLMs.
  (Eugene Loh, Bruce McCulloch, Ruud van der Pas, Elena Zannoni).
- Allow [u]stack() to be used as a variable value.  (Kris Van Hees)
  [Orabug: 37950533]
- Comments using // are now supported.  (Kris Van Hees)
- Scalability improvements.  (Kris Van Hees)
- Error injection via return() action.  (Kris Van Hees)
- Improved string handling.  (Kris Van Hees)
- Various bug fixes.  (Eugene Loh, Kris Van Hees)
- Fix dyn vars overwriting one another.  [Orabug: 37994729]
- Fix regression:  list fbt probes by default.  [Orabug: 38249511]
- Various testsuite fixes and improvements.
  (Nick Alcock, Eugene Loh, Alan Maguire, Kris Van Hees)
- Add test for preprocessor definitions.  [Orabug: 28763074]
- Fix some stack tests.  [Orabug: 37459289]</changelog>
  <changelog author="Eugene Loh &lt;eugene.loh@oracle.com&gt; - 2.0.5-1" date="1770206400">- Implement PID-specific uprobes.  (Kris Van Hees)
- Allocate the buffers BPF map to fit highest CPU id.  (Kris Van Hees)
- Fix argument handling for multi-location user probes.
  (Kris Van Hees) [Orabug: 38922360]
- Change the "stack skip" to 3 for fbt (fprobe) and rawtp providers.
  [Orabug: 38776929]
- Fix prvname so that both rawfbt and fbt probes are seen.
  [Orabug: 38842114]
- Do not convert "__" to "-" for stapsdt provider names.
- Fix printf formatting with non-monetary grouping chars.
  [Orabug: 30430270]
- Discontinue -xversion=V as an option.  (Kris Van Hees) [Orabug: 38615307]
- Add the DTrace Tutorial to the git repo and install package.
- Add missing documentation:  trunc(), stapsdt, usdt.h include path.
- Update LLM context files to forbid "if" statements.
- Test suite weakly pulls in kernel-uek-tools to get perf.  (Nick Alcock)
  [Orabug: 38064413]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.6-1" date="1773057600">- Fix dtprobed unsafe probe description handling (CVE-2026-21991).
  [Orabug: 39054018]</changelog>
  <changelog author="Kris Van Hees &lt;kris.van.hees@oracle.com&gt; - 2.0.7-4" date="1777464000">- Prevent out-of-buonds memory access during object symbol table construction
  (CVE-2026-35233).  [Orabug: 39121881]
- Prevent divide-by-zero (FPE trap) if section header data is corrupted.
  (CVE-2026-21996).  [Orabug: 39121874]
- Ensure safety checks are performed on program header data from ELF objects.
- Ensure that the data of string table sections is proper terminated.
- Ensure that the symbol table references a valid string table.</changelog>
</package>
<package pkgid="8746879e39562a706920765789d52c769b68dd03" name="dwarves" arch="aarch64">
  <version epoch="0" ver="1.28" rel="1.el10"/>
  <changelog author="Mohan Boddu &lt;mboddu@redhat.com&gt; - 1.20-2" date="1618488000">- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937</changelog>
  <changelog author="Jiri Olsa &lt;jolsa@redhat.com&gt; - 1.21-1" date="1620993600">- remove ftrace filter
- New release: v1.21
- DWARF loader:
- Handle DWARF5 DW_OP_addrx properly
- Handle subprogram ret type with abstract_origin properly
- Check .notes section for LTO build info
- Check .debug_abbrev for cross-CU references
- Permit merging all DWARF CU's for clang LTO built binary
- Factor out common code to initialize a cu
- Permit a flexible HASHTAGS__BITS
- Use a better hashing function, from libbpf
- btf_encoder:
- Add --btf_gen_all flag
- Match ftrace addresses within ELF functions
- Funnel ELF error reporting through a macro
- Sanitize non-regular int base type
- Add support for the floating-point types
- Pretty printer:
- Honour conf_fprintf.hex when printing enumerations</changelog>
  <changelog author="Mohan Boddu &lt;mboddu@redhat.com&gt; - 1.21-2" date="1628510400">- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
  Related: rhbz#1991688</changelog>
  <changelog author="Jiri Olsa &lt;jolsa@redhat.com&gt; - 1.22-1" date="1633521600">- New release: v1.22
- Resolves: rhbz#2010414
- Introduce -j/--jobs option to specify the number of threads to use.
- Multithreaded DWARF loading, requires elfutils &gt;= 0.178.
- Preparatory work for multithreaded BTF encoding, the focus for 1.23.
- Allow encoding BTF to a separate file.
- Show all different types with the same name, not just the first one found.
- Stop assuming that reading from stdin means pretty, add --prettify.
- Improve type resolution for the --header command line option.
- Do not consider the ftrace filter when encoding BTF for kernel functions.
- Lock calls to non-thread safe elfutils' dwarf_decl_file() and dwarf_decl_line().
- Change hash table size to one that performs better with current typical vmlinux files.
- Allow tweaking the hash table size from the command line.
- Add --kabi_prefix to avoid deduplication woes when using _RH_KABI_REPLACE().
- Add --with_flexible_array to show just types with flexible arrays.
- Support btfdiff with a detached BTF file.
- Introduce sorted type output (--sort).
- Disable incomplete CTF encoder.</changelog>
  <changelog author="Viktor Malik &lt;vmalik@redhat.com&gt; - 1.24-1" date="1667563200">- Resolves: rhbz#2140020
- New release: v1.23
- Process DW_TAG_LLVM_annotation tags.
- Initial support for DW_TAG_skeleton_unit.
- Encode BTF_KIND_TYPE_TAG and BTF_KIND_DECL_TAG
- Fix handling of percpu symbols on s390.
- Use cacheline size to infer struct member alignment from BTF.
- Add --skip_missing to not stop when not finding one of -C arguments.
- Fix __attribute__((__aligned__(N)) printing alignment for struct members.
- Fix nested __attribute__(__aligned__(N)) struct printing order.
- New release: v1.24
- Add support to BTF_KIND_ENUM64.
- Support multithreaded BTF encoding.
- Encode char type as signed in BTF.
- Introduce --lang and --lang_exclude to pahole.
- Introduce --compile to pahole.
- Don't segfault when processing bogus files.</changelog>
  <changelog author="Viktor Malik &lt;vmalik@redhat.com&gt; - 1.24-2" date="1668600000">- Backport BTF fix needed for kernel kfuncs
- Related: rhbz#2140020</changelog>
  <changelog author="Viktor Malik &lt;vmalik@redhat.com&gt; - 1.25-1" date="1686744000">- Resolves: rhbz#2190484
- Build with system libbpf
- New release: v1.25
- Support for DW_TAG_unspecified_type more generally.
- Make sure struct member offsets are in ascending order. Rust BTF needs this.
- Support C atomic types (DW_TAG_atomic_type).
- Initial support for DW_TAG_LLVM_annotation, used for BTF type tags, for __rcu, __user, etc
- Exclude functions with the same name (static functions in different CUs), inconsistent prototypes or not following calling convention.
- Allow generation of BTF for optimized functions, those that end with a .isra*, .constprop*.
- Support 'pahole --lang=/--lang_exclude=asm'
- Support --compile from DWARF in addition to from BTF.
- Exclude RUST CUs in 'btfdiff', as those are not yet being BTF encoded.</changelog>
  <changelog author="Viktor Malik &lt;vmalik@redhat.com&gt; - 1.27-1" date="1718884800">- Resolves: RHEL-30780
- New release: v1.26
- When expanding types using 'pahole -E' do it for union and struct typedefs and for enums too.
- Print number of holes, bit holes and bit paddings in class member types.
- Introduce --contains_enumerator=ENUMERATOR_NAME:
- Fix pretty printing using DWARF, waiting for a CU with both class (-C) and a specified "type_enum".
- Add support for DW_TAG_constant in the DWARF loader, first seen in Go DWARF.
- Fix loading DW_TAG_subroutine_type generated by the Go compiler.
- Fix loading of 32-bit signed enums from BTF.
- Add 'pahole --btf_features' to allow consumers to specify an opt-in set of features they want to use in BTF encoding.
- Parallelize loading BTF and DWARF, speeding up a bit btfdiff.
- Do type expansion to cover "private" types and enumerations in btfdiff.
- New release: v1.27
- Reproducible parallel builds: multiple runs with different number of loading/encoding threads produce the same result.
- Inject kfunc decl tags into BTF from the BTF IDs ELF section in the Linux kernel vmlinux file.
- Sanitize unsupported DWARF int type with greater-than-16 byte, as BTF doesn't support it.
- Initial support for BTF_KIND_DECL_TAG in the BTF loader, adding support in pfunct output.
- Fix hole discovery with inheritance in C++.</changelog>
  <changelog author="Davide Cavalca &lt;dcavalca@centosproject.org&gt; - 1.27-2" date="1723464000">- Backport upstream bugfixes for clang builds
  Resolves: RHEL-54022</changelog>
  <changelog author="Alan Maguire &lt;alan.maguire@oracle.com&gt; - 1.28-1" date="1736769600">- Build new dwarves release, depends on libbpf-devel v1.5 [Orabug: 37277258]</changelog>
</package>
<package pkgid="87cf638cc8423c78657e032d7e29f3b0df67fa31" name="dwarves" arch="src">
  <version epoch="0" ver="1.28" rel="1.el10"/>
  <changelog author="Mohan Boddu &lt;mboddu@redhat.com&gt; - 1.20-2" date="1618488000">- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937</changelog>
  <changelog author="Jiri Olsa &lt;jolsa@redhat.com&gt; - 1.21-1" date="1620993600">- remove ftrace filter
- New release: v1.21
- DWARF loader:
- Handle DWARF5 DW_OP_addrx properly
- Handle subprogram ret type with abstract_origin properly
- Check .notes section for LTO build info
- Check .debug_abbrev for cross-CU references
- Permit merging all DWARF CU's for clang LTO built binary
- Factor out common code to initialize a cu
- Permit a flexible HASHTAGS__BITS
- Use a better hashing function, from libbpf
- btf_encoder:
- Add --btf_gen_all flag
- Match ftrace addresses within ELF functions
- Funnel ELF error reporting through a macro
- Sanitize non-regular int base type
- Add support for the floating-point types
- Pretty printer:
- Honour conf_fprintf.hex when printing enumerations</changelog>
  <changelog author="Mohan Boddu &lt;mboddu@redhat.com&gt; - 1.21-2" date="1628510400">- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
  Related: rhbz#1991688</changelog>
  <changelog author="Jiri Olsa &lt;jolsa@redhat.com&gt; - 1.22-1" date="1633521600">- New release: v1.22
- Resolves: rhbz#2010414
- Introduce -j/--jobs option to specify the number of threads to use.
- Multithreaded DWARF loading, requires elfutils &gt;= 0.178.
- Preparatory work for multithreaded BTF encoding, the focus for 1.23.
- Allow encoding BTF to a separate file.
- Show all different types with the same name, not just the first one found.
- Stop assuming that reading from stdin means pretty, add --prettify.
- Improve type resolution for the --header command line option.
- Do not consider the ftrace filter when encoding BTF for kernel functions.
- Lock calls to non-thread safe elfutils' dwarf_decl_file() and dwarf_decl_line().
- Change hash table size to one that performs better with current typical vmlinux files.
- Allow tweaking the hash table size from the command line.
- Add --kabi_prefix to avoid deduplication woes when using _RH_KABI_REPLACE().
- Add --with_flexible_array to show just types with flexible arrays.
- Support btfdiff with a detached BTF file.
- Introduce sorted type output (--sort).
- Disable incomplete CTF encoder.</changelog>
  <changelog author="Viktor Malik &lt;vmalik@redhat.com&gt; - 1.24-1" date="1667563200">- Resolves: rhbz#2140020
- New release: v1.23
- Process DW_TAG_LLVM_annotation tags.
- Initial support for DW_TAG_skeleton_unit.
- Encode BTF_KIND_TYPE_TAG and BTF_KIND_DECL_TAG
- Fix handling of percpu symbols on s390.
- Use cacheline size to infer struct member alignment from BTF.
- Add --skip_missing to not stop when not finding one of -C arguments.
- Fix __attribute__((__aligned__(N)) printing alignment for struct members.
- Fix nested __attribute__(__aligned__(N)) struct printing order.
- New release: v1.24
- Add support to BTF_KIND_ENUM64.
- Support multithreaded BTF encoding.
- Encode char type as signed in BTF.
- Introduce --lang and --lang_exclude to pahole.
- Introduce --compile to pahole.
- Don't segfault when processing bogus files.</changelog>
  <changelog author="Viktor Malik &lt;vmalik@redhat.com&gt; - 1.24-2" date="1668600000">- Backport BTF fix needed for kernel kfuncs
- Related: rhbz#2140020</changelog>
  <changelog author="Viktor Malik &lt;vmalik@redhat.com&gt; - 1.25-1" date="1686744000">- Resolves: rhbz#2190484
- Build with system libbpf
- New release: v1.25
- Support for DW_TAG_unspecified_type more generally.
- Make sure struct member offsets are in ascending order. Rust BTF needs this.
- Support C atomic types (DW_TAG_atomic_type).
- Initial support for DW_TAG_LLVM_annotation, used for BTF type tags, for __rcu, __user, etc
- Exclude functions with the same name (static functions in different CUs), inconsistent prototypes or not following calling convention.
- Allow generation of BTF for optimized functions, those that end with a .isra*, .constprop*.
- Support 'pahole --lang=/--lang_exclude=asm'
- Support --compile from DWARF in addition to from BTF.
- Exclude RUST CUs in 'btfdiff', as those are not yet being BTF encoded.</changelog>
  <changelog author="Viktor Malik &lt;vmalik@redhat.com&gt; - 1.27-1" date="1718884800">- Resolves: RHEL-30780
- New release: v1.26
- When expanding types using 'pahole -E' do it for union and struct typedefs and for enums too.
- Print number of holes, bit holes and bit paddings in class member types.
- Introduce --contains_enumerator=ENUMERATOR_NAME:
- Fix pretty printing using DWARF, waiting for a CU with both class (-C) and a specified "type_enum".
- Add support for DW_TAG_constant in the DWARF loader, first seen in Go DWARF.
- Fix loading DW_TAG_subroutine_type generated by the Go compiler.
- Fix loading of 32-bit signed enums from BTF.
- Add 'pahole --btf_features' to allow consumers to specify an opt-in set of features they want to use in BTF encoding.
- Parallelize loading BTF and DWARF, speeding up a bit btfdiff.
- Do type expansion to cover "private" types and enumerations in btfdiff.
- New release: v1.27
- Reproducible parallel builds: multiple runs with different number of loading/encoding threads produce the same result.
- Inject kfunc decl tags into BTF from the BTF IDs ELF section in the Linux kernel vmlinux file.
- Sanitize unsupported DWARF int type with greater-than-16 byte, as BTF doesn't support it.
- Initial support for BTF_KIND_DECL_TAG in the BTF loader, adding support in pfunct output.
- Fix hole discovery with inheritance in C++.</changelog>
  <changelog author="Davide Cavalca &lt;dcavalca@centosproject.org&gt; - 1.27-2" date="1723464000">- Backport upstream bugfixes for clang builds
  Resolves: RHEL-54022</changelog>
  <changelog author="Alan Maguire &lt;alan.maguire@oracle.com&gt; - 1.28-1" date="1736769600">- Build new dwarves release, depends on libbpf-devel v1.5 [Orabug: 37277258]</changelog>
</package>
<package pkgid="0ed411bcb6fbf53e1801b2b4c5a5776473d7a896" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="100.28.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.2.el10uek]" date="1751198400">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
</package>
<package pkgid="33ea3ee5ab431661ec64d92be0f1a8245fb053e2" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="100.28.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.2.el10uek]" date="1751198400">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
</package>
<package pkgid="47acee658928f7e8e4f0b813a61c8801396a47c2" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="100.28.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.el10uek]" date="1743681600">- block: prevent calls to should_fail_bio() optimized by gcc (Prasad Singamsetty)  [Orabug: 37782458]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)   
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]  
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]  
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
</package>
<package pkgid="64574976585c234b415e04ba1342f476befadaba" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="100.28.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.el10uek]" date="1743681600">- block: prevent calls to should_fail_bio() optimized by gcc (Prasad Singamsetty)  [Orabug: 37782458]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)   
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]  
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]  
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
</package>
<package pkgid="ad7e66b6f8de684a7a337dc25b5211f60e288e13" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="101.33.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge) [Orabug: 37976747] {CVE-2025-37903}
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi) [Orabug: 37976752] {CVE-2025-37905}
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [Orabug: 37976858] {CVE-2025-37932}
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski) [Orabug: 37976760] {CVE-2025-37907}
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang) [Orabug: 37976762] {CVE-2025-37908}
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh Edara) [Orabug: 37976864] {CVE-2025-37933}
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan) [Orabug: 37976765] {CVE-2025-37909}
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon) [Orabug: 37976771] {CVE-2025-37910}
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang) [Orabug: 37976728] {CVE-2025-37894}
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein) [Orabug: 37976869] {CVE-2025-37934}
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab) [Orabug: 37976773] {CVE-2025-37911}
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh Ap)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya Kn) [Orabug: 37976731] {CVE-2025-37895}
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe) [Orabug: 37976872] {CVE-2025-37935}
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai) [Orabug: 37970918] {CVE-2025-37891}
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Luoxuanqiang) [Orabug: 37976779] {CVE-2025-37912}
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976783] {CVE-2025-37913}
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976788] {CVE-2025-37914}
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira) [Orabug: 37970915] {CVE-2025-37890}
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976792] {CVE-2025-37915}
- pds_core: remove write-after-free of client_id (Shannon Nelson) [Orabug: 37976797] {CVE-2025-37916}
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud) [Orabug: 37976802] {CVE-2025-37917}
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu) [Orabug: 37976804] {CVE-2025-37918}
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu) [Orabug: 37976806] {CVE-2025-37919}
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (Eryk Kubanski) [Orabug: 37976809] {CVE-2025-37920}
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel) [Orabug: 37976815] {CVE-2025-37921}
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov) [Orabug: 37976734] {CVE-2025-37897}
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom) [Orabug: 37976819] {CVE-2025-37922}
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Sun Peng Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park) [Orabug: 37976821] {CVE-2025-37923}
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan) [Orabug: 37976738] {CVE-2025-37899}
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan) [Orabug: 37976828] {CVE-2025-37924}
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon) [Orabug: 37976832] {CVE-2025-37926}
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen) [Orabug: 37976741] {CVE-2025-37900}
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov) [Orabug: 37976836] {CVE-2025-37927}
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (Longping Wei) [Orabug: 37976844] {CVE-2025-37928}
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Xu Wang) [Orabug: 37977118] {CVE-2025-37990}
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold) [Orabug: 37976744] {CVE-2025-37901}
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson) [Orabug: 37976874] {CVE-2025-37936}
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller) [Orabug: 37977127] {CVE-2025-37991}
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon) [Orabug: 37977182] {CVE-2025-37929}
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner) [Orabug: 37976850] {CVE-2025-37930}
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik) [Orabug: 37976853] {CVE-2025-37931}
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya) [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil) [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert) [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter) [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King) [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche) [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert) [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar) [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang) [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli) [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre) [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta) [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon) [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon) [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth) [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth) [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick) [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli) [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval) [Orabug: 37930100] {CVE-2025-37821}
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang) [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed) [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan) [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.31.1.el10uek]" date="1748952000">- LTS version: v6.12.31 (Jack Vogel)
- drm/gem: Internally test import_attach for imported objects (Thomas Zimmermann)
- x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers (Balbir Singh)
- i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() (Nathan Chancellor)
- pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group() (Dan Carpenter)
- watchdog: aspeed: fix 64-bit division (Arnd Bergmann)
- drm/amdkfd: Correct F8_MODE for gfx950 (Amber Lin)
- serial: sh-sci: Save and restore more registers (Geert Uytterhoeven)
- bpf: abort verification if env-&gt;cur_state-&gt;loop_entry != NULL (Eduard Zingerman)
- drm/amd/display: Exit idle optimizations before accessing PHY (Ovidiu Bunea)
- kbuild: Properly disable -Wunterminated-string-initialization for clang (Nathan Chancellor)
- Fix mis-uses of 'cc-option' for warning disablement (Linus Torvalds)
- gcc-15: disable '-Wunterminated-string-initialization' entirely for now (Linus Torvalds)
- gcc-15: make 'unterminated string initialization' just a warning (Linus Torvalds)
- err.h: move IOMEM_ERR_PTR() to err.h (Raag Jadav)
- spi: spi-fsl-dspi: Reset SR flags before sending a new message (Larisa Grigore)
- spi: spi-fsl-dspi: Halt the module after a new message transfer (Bogdan-Gabriel Roman)
- spi: spi-fsl-dspi: restrict register range for regmap access (Larisa Grigore)
- spi: use container_of_cont() for to_spi_device() (Greg Kroah-Hartman)
- platform/x86: think-lmi: Fix attribute name usage for non-compliant items (Mark Pearson)
- ksmbd: fix stream write failure (Namjae Jeon)
- Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection" (Jernej Skrabec)
- Bluetooth: btmtksdio: Do close if SDIO card removed without close (Chris Lu)
- Bluetooth: btmtksdio: Check function enabled before doing close (Chris Lu)
- nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() (Ryusuke Konishi)
- mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled (Ignacio Moreno Gonzalez)
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Tianyang Zhang)
- memcg: always call cond_resched() after fn() (Breno Leitao)
- highmem: add folio_test_partial_kmap() (Matthew Wilcox)
- Input: xpad - add more controllers (Vicki Pfau)
- Revert "drm/amd: Keep display off while going into S4" (Mario Limonciello)
- smb: client: Reset all search buffer pointers when releasing buffer (Zhaolong Wang)
- arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (Gabor Juhos)
- smb: client: Fix use-after-free in cifs_fill_dirent (Zhaolong Wang) [Orabug: 38094970] {CVE-2025-38051}
- drm/edid: fixed the bug that hdr metadata was not reset (Feijuan Li)
- thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature (Zhang Rui)
- platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin) [Orabug: 38095141] {CVE-2025-38077}
- pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
- pmdomain: renesas: rcar: Remove obsolete nullify checks (Geert Uytterhoeven)
- vmxnet3: update MTU after device quiesce (Ronak Doshi)
- net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
- can: kvaser_pciefd: Fix echo_skb race (Axel Forsman)
- can: kvaser_pciefd: Continue parsing DMA buf after dropped RX (Axel Forsman)
- llc: fix data loss when reading from a socket in llc_ui_recvmsg() (Gavrilov Ilia)
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10 (Ed Burcher)
- ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [Orabug: 38095145] {CVE-2025-38078}
- ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction (Peter Ujfalusi)
- ASoc: SOF: topology: connect DAI to a single DAI link (Kai Vehmanen)
- ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext (Peter Ujfalusi)
- can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp) [Orabug: 38049369] {CVE-2025-38003}
- can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 38049374] {CVE-2025-38004}
- can: slcan: allow reception of short error messages (Carlos Sanchez)
- padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094842] {CVE-2025-38031}
- crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [Orabug: 38095153] {CVE-2025-38079}
- clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe() (André Draszik)
- octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG (Geetha Sowjanya)
- octeontx2-af: Set LMT_ENA bit for APR table entries (Subbaraya Sundeep)
- net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang) [Orabug: 38094978] {CVE-2025-38052}
- octeontx2-pf: Add AF_XDP non-zero copy support (Suman Ghosh)
- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [Orabug: 38049357] {CVE-2025-38000}
- idpf: fix idpf_vport_splitq_napi_poll() (Eric Dumazet)
- io_uring: fix overflow resched cqe reordering (Pavel Begunkov)
- net: lan743x: Restore SGMII CTRL register on resume (Thangaraj Samynathan)
- net: dwmac-sun8i: Use parsed internal PHY address instead of 1 (Paul Kocialkowski)
- pinctrl: qcom: switch to devm_register_sys_off_handler() (Dmitry Baryshkov)
- loop: don't require -&gt;write_iter for writable files in loop_configure (Christoph Hellwig)
- idpf: fix null-ptr-deref in idpf_features_check (Pavan Kumar Linga) [Orabug: 38094982] {CVE-2025-38053}
- ice: Fix LACP bonds without SRIOV environment (Dave Ertman)
- ice: fix vf-&gt;num_mac count with port representors (Jacob Keller)
- bridge: netfilter: Fix forwarding of fragmented packets (Ido Schimmel)
- ptp: ocp: Limit signal/freq counts in summary output functions (Sagi Maimon) [Orabug: 38094984] {CVE-2025-38054}
- Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling (En-Wei Wu)
- Bluetooth: L2CAP: Fix not checking l2cap_chan security level (Luiz Augusto von Dentz)
- perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter) [Orabug: 38094988] {CVE-2025-38055}
- irqchip/riscv-imsic: Start local sync timer on correct CPU (Andrew Bresticker)
- ASoC: SOF: Intel: hda: Fix UAF when reloading module (Tavian Barnes) [Orabug: 38094991] {CVE-2025-38056}
- devres: Introduce devm_kmemdup_array() (Raag Jadav)
- driver core: Split devres APIs to device/devres.h (Andy Shevchenko)
- dmaengine: fsl-edma: Fix return code for unhandled interrupts (Stefan Wahren)
- dmaengine: idxd: Fix -&gt;poll() return value (Dave Jiang)
- xfrm: Sanitize marks before insert (Paul Chaignon)
- clk: sunxi-ng: d1: Add missing divider for MMC mod clocks (Andre Przywara)
- remoteproc: qcom_wcnss: Fix on platforms without fallback regulators (Matti Lehtimäki)
- kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() (David Hildenbrand)
- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (Seongman Lee)
- dmaengine: idxd: Fix allowing write() from different address spaces (Vinicius Costa Gomes)
- xfrm: Fix UDP GRO handling for some corner cases (Tobias Brunner)
- espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca)
- espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094993] {CVE-2025-38057}
- soundwire: bus: Fix race on the creation of the IRQ domain (Charles Keepax)
- __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [Orabug: 38095000] {CVE-2025-38058}
- drm/amd/display: Call FP Protect Before Mode Programming/Mode Support (Austin Zheng)
- xenbus: Allow PVH dom0 a non-local xenstore (Jason Andryuk)
- x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust &gt;= 1.88 (Paweł Anikiel) [Orabug: 38094847] {CVE-2025-38033}
- wifi: iwlwifi: add support for Killer on MTL (Johannes Berg)
- block: only update request sector if needed (Johannes Thumshirn)
- tools: ynl-gen: validate 0 len strings from kernel (David Wei)
- btrfs: avoid NULL pointer dereference if no valid csum tree (Qu Wenruo) [Orabug: 38095010] {CVE-2025-38059}
- btrfs: handle empty eb-&gt;folios in num_extent_folios() (Boris Burkov)
- btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [Orabug: 38094856] {CVE-2025-38034}
- btrfs: compression: adjust cb-&gt;compressed_folios allocation type (Kees Cook)
- ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers (Stefan Binding)
- cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function (Pali Rohár)
- cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info() (Pali Rohár)
- io_uring/fdinfo: annotate racy sq/cq head/tail reads (Jens Axboe)
- nvmet-tcp: don't restore null sk_state_change (Alistair Francis) [Orabug: 38094863] {CVE-2025-38035}
- ALSA: usb-audio: Fix duplicated name in MIDI substream names (Takashi Iwai)
- nvme-pci: add quirks for WDC Blue SN550 15b7:5009 (Guan Wentao)
- nvme-pci: add quirks for device 126f:1001 (Guan Wentao)
- ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 (Takashi Iwai)
- ASoC: cs42l43: Disable headphone clamps during type detection (Charles Keepax)
- platform/x86: ideapad-laptop: add support for some new buttons (Gašper Nemgar)
- platform/x86: asus-wmi: Disable OOBE state after resume from hibernation (Pavel Nikulin)
- platform/x86/intel: hid: Add Pantherlake support (Saranya Gopal)
- smb: server: smb2pdu: check return value of xa_store() (Salah Triki)
- pinctrl: meson: define the pull up/down resistor value as 60 kOhm (Martin Blumenstingl)
- book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n (Ritesh Harjani)
- ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of() (Chenyuan Yang)
- drm: Add valid clones check (Jessica Zhang)
- drm/panel-edp: Add Starry 116KHD024006 (Douglas Anderson)
- drm/buddy: fix issue that force_merge cannot free all roots (Lin Cao)
- drm/atomic: clarify the rules around drm_atomic_state-&gt;allow_modeset (Simona Vetter)
- drm/xe: Reject BO eviction if BO is bound to current VM (Oak Zeng)
- drm/xe/sa: Always call drm_suballoc_manager_fini() (Michal Wajdeczko)
- wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event (Ching-Te Ku)
- drm/xe: Do not attempt to bootstrap VF in execlists mode (Maarten Lankhorst)
- drm/xe: Move suballocator init to after display init (Maarten Lankhorst)
- wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (P Praneesh)
- drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE (Zhi Wang)
- drm: bridge: adv7511: fill stream capabilities (Olivier Moysan)
- wifi: ath12k: Fix end offset bit definition in monitor ring descriptor (P Praneesh)
- wifi: ath12k: Fetch regdb.bin file from board-2.bin (Aaradhana Sahu)
- wifi: ath9k: return by of_get_mac_address (Rosen Penev)
- drm/xe/pf: Reset GuC VF config when unprovisioning critical resource (Michal Wajdeczko)
- accel/qaic: Mask out SR-IOV PCI resources (Youssef Samir)
- wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override (Nicolas Escande)
- regulator: ad5398: Add device tree support (Isaac Scott)
- spi: zynqmp-gqspi: Always acknowledge interrupts (Sean Anderson)
- wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet (Ping-Ke Shih)
- wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate (Bitterblue Smith)
- wifi: rtl8xxxu: retry firmware download on error (Soeren Moch)
- clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation (Lad Prabhakar)
- perf/amd/ibs: Fix -&gt;config to sample period calculation for OP PMU (Ravi Bangoria)
- perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (Ravi Bangoria)
- firmware: arm_scmi: Relax duplicate name constraint across protocol ids (Sudeep Holla)
- bpftool: Fix readlink usage in get_fd_type (Viktor Malik)
- bpf: Use kallsyms to find the function name of a struct_ops's stub function (Martin Kafai Lau)
- drm/ast: Find VBIOS mode from regular display size (Thomas Zimmermann)
- dm vdo: use a short static string for thread name prefix (Matthew Sakai)
- dm vdo indexer: prevent unterminated string warning (Chung Chung)
- irqchip/riscv-aplic: Add support for hart indexes (Vladimir Kondratiev)
- ASoC: rt722-sdca: Add some missing readable registers (Charles Keepax)
- ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode (Cezary Rojewski)
- arm64: zynqmp: add clock-output-names property in clock nodes (Naman Trivedi Manojbhai)
- HID: usbkbd: Fix the bit shift number for LED_KANA (Junan)
- wifi: ath12k: Avoid napi_sync() before napi_enable() (Avula Sri Charan)
- scsi: st: Restore some drive settings after reset (Kai Mäkisara)
- net/mana: fix warning in the writer of client oob (Konstantin Taranov)
- drm/xe/relay: Don't use GFP_KERNEL for new transactions (Michal Wajdeczko)
- ice: count combined queues using Rx/Tx count (Michal Swiatkowski)
- perf: Avoid the read if the count is already updated (Peter Zijlstra)
- rcu: fix header guard for rcu_all_qs() (Ankur Arora)
- rcu: handle unstable rdp in rcu_read_unlock_strict() (Ankur Arora)
- rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y (Ankur Arora)
- ice: treat dyn_allowed only as suggestion (Michal Swiatkowski)
- ice: init flow director before RDMA (Michal Swiatkowski)
- bridge: mdb: Allow replace of a host-joined group (Petr Machata)
- net: flush_backlog() small changes (Eric Dumazet)
- r8169: don't scan PHY addresses &gt; 0 (Heiner Kallweit)
- ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only (Geert Uytterhoeven)
- vxlan: Annotate FDB data races (Ido Schimmel) [Orabug: 38094879] {CVE-2025-38037}
- cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (Dhananjay Ugwekar) [Orabug: 38094888] {CVE-2025-38038}
- tools: ynl-gen: don't output external constants (Jakub Kicinski)
- eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs (Alexander Duyck)
- drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0 (Cristian Ciocaltea)
- media: qcom: camss: Add default case in vfe_src_pad_code (Depeng Shao)
- media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available (Depeng Shao)
- f2fs: introduce f2fs_base_attr for global sysfs entries (Jaegeuk Kim)
- hwmon: (xgene-hwmon) use appropriate type for the latency value (Andrey Vatoropin)
- tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options (Len Brown)
- net: page_pool: avoid false positive warning if NAPI was never added (Jakub Kicinski)
- clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs (Jordan Crouse)
- wifi: rtw89: call power_on ahead before selecting firmware (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before accessing (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before getting its size (Ping-Ke Shih)
- wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang (Ching-Te Ku)
- wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix download_firmware_validate() for RTL8814AU (Bitterblue Smith)
- ext4: remove writable userspace mappings before truncating page cache (Zhang Yi)
- ext4: don't write back data before punch hole in nojournal mode (Zhang Yi)
- leds: trigger: netdev: Configure LED blink interval for HW offload (Marek Vasut)
- pstore: Change kmsg_bytes storage size to u32 (Kees Cook)
- iio: adc: ad7944: don't use storagebits for sizing (David Lechner)
- r8152: add vendor/device ID pair for Dell Alienware AW1022z (Aleksander Jan Bajkowski)
- ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). (Kuniyuki Iwashima)
- arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src (Athira Rajeev)
- powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (Gaurav Batra)
- powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Gaurav Batra)
- net: fec: Refactor MAC reset to function (Csókás Bence)
- wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx (Emmanuel Grumbach)
- wifi: mac80211: remove misplaced drv_mgd_complete_tx() call (Johannes Berg)
- wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() (Johannes Berg)
- wifi: iwlwifi: don't warn during reprobe (Miri Korenblit)
- wifi: iwlwifi: use correct IMR dump variable (Johannes Berg)
- mptcp: pm: userspace: flags: clearer msg if no remote addr (Matthieu Baerts)
- wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV (P Praneesh)
- xfrm: prevent high SEQ input in non-ESN mode (Leon Romanovsky)
- drm/v3d: Add clock handling (Stefan Wahren)
- net/mlx5e: reduce the max log mpwrq sz for ECPF and reps (William Tu)
- net/mlx5e: reduce rep rxq depth to 256 for ECPF (William Tu)
- net/mlx5e: set the tx_queue_len for pfifo_fast (William Tu)
- net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB (Alexei Lazar)
- net/mlx5: XDP, Enable TX side XDP multi-buffer support (Alexei Lazar)
- scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr() (Chaohai Chen)
- drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer() (Alex Deucher)
- drm/amdgpu: enlarge the VBIOS binary size limit (Morris Zhang)
- drm/amdgpu: Use active umc info from discovery (Lijo Lazar)
- drm/amd/display: Populate register address for dentist for dcn401 (Dillon Varone)
- drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It (Austin Zheng)
- drm/amd/display: Increase block_sequence array size (Joshua Aberback) [Orabug: 38095164] {CVE-2025-38080}
- drm/amd/display: Initial psr_version with correct setting (Tom Chung)
- drm/amd/display: Update CR AUX RD interval interpretation (George Shen)
- Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY" (Brandon Syu)
- drm/amd/display: Support multiple options during psr entry. (Martin Tsai)
- drm/amd/pm: Skip P2S load for SMU v13.0.12 (Asad Kamal)
- drm/amdgpu: reset psp-&gt;cmd to NULL after releasing the buffer (Jiang Liu)
- drm/amd/display: Don't try AUX transactions on disconnected link (Ilya Bakoulin)
- drm/amd/display: pass calculated dram_speed_mts to dml2 (Charlene Liu)
- drm/amdgpu: Set snoop bit for SDMA for MI series (Harish Kasiviswanathan)
- drm/amdkfd: fix missing L2 cache info in topology (Eric Huang)
- drm/amdgpu/mes11: fix set_hw_resources_1 calculation (Alex Deucher)
- net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size (Huacai Chen)
- soundwire: cadence_master: set frame shape and divider based on actual clk freq (Bard Liao)
- soundwire: amd: change the soundwire wake enable/disable sequence (Vijendar Mukunda)
- phy: exynos5-usbdrd: fix EDS distribution tuning (gs101) (André Draszik)
- phy: core: don't require set_mode() callback for phy_get_mode() to work (Dmitry Baryshkov)
- phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF (Damon Ding)
- pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down (Claudiu Beznea)
- serial: sh-sci: Update the suspend/resume support (Claudiu Beznea)
- sched: Reduce the default slice to avoid tasks getting an extra tick (Zihan Zhou)
- x86/traps: Cleanup and robustify decode_bug() (Peter Zijlstra)
- x86/ibt: Handle FineIBT in handle_cfi_failure() (Peter Zijlstra)
- drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set (Shuicheng Lin)
- drm/xe/debugfs: fixed the return value of wedged_mode_set (Xin Wang)
- clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate (Krzysztof Kozlowski)
- clk: qcom: ipq5018: allow it to be bulid on arm32 (Karl Chan)
- drm/xe: Fix xe_tile_init_noalloc() error propagation (Lucas De Marchi)
- drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init() (Lucas De Marchi)
- net/mlx4_core: Avoid impossible mlx4_db_alloc() order value (Kees Cook)
- media: v4l: Memset argument to 0 before calling get_mbus_config pad op (Sakari Ailus)
- media: i2c: imx219: Correct the minimum vblanking value (David Plowman)
- kunit: tool: Use qboot on QEMU x86_64 (Brendan Jackman)
- smack: Revert "smackfs: Added check catlen" (Konstantin Andreev)
- smack: recognize ipv4 CIPSO w/o categories (Konstantin Andreev)
- pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map (Valentin Caron)
- ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() (Kuninori Morimoto)
- ASoC: tas2764: Power up/down amp on mute ops (Hector Martin)
- ASoC: tas2764: Mark SW_RESET as volatile (Hector Martin)
- ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG (Hector Martin)
- ASoC: ops: Enforce platform maximum on initial value (Martin Povišer)
- firmware: xilinx: Dont send linux address to get fpga config get status (Siva Durga Prasad Paladugu)
- firmware: arm_ffa: Handle the presence of host partition in the partition info (Sudeep Holla)
- firmware: arm_ffa: Reject higher major version as incompatible (Sudeep Holla)
- net/mlx5: Apply rate-limiting to high temperature warning (Shahar Shitrit)
- net/mlx5: Modify LSB bitmask in temperature event to include only the first bit (Shahar Shitrit)
- media: test-drivers: vivid: don't call schedule in loop (Hans Verkuil)
- irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base (Andrew Jones)
- hrtimers: Replace hrtimer_clock_to_base_table with switch-case (Andy Shevchenko)
- vxlan: Join / leave MC group after remote changes (Petr Machata)
- ACPI: HED: Always initialize before evged (Xiaofei Tan)
- PCI: Fix old_size lower bound in calculate_iosize() too (Ilpo Järvinen)
- eth: mlx4: don't try to complete XDP frames in netpoll (Jakub Kicinski)
- bpf: copy_verifier_state() should copy 'loop_entry' field (Eduard Zingerman) [Orabug: 38095018] {CVE-2025-38060}
- bpf: don't do clean_live_states when state-&gt;loop_entry-&gt;branches &gt; 0 (Eduard Zingerman)
- can: c_can: Use of_property_present() to test existence of DT property (Krzysztof Kozlowski)
- pmdomain: imx: gpcv2: use proper helper for property detection (Ahmad Fatoum)
- RDMA/core: Fix best page size finding when it can cross SG entries (Michael Margolin)
- serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (Alexis Lothoré) [Orabug: 38094901] {CVE-2025-38040}
- drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink (Harry Wentland)
- Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP" (Leo Zeng)
- drm/amd/display: Read LTTPR ALPM caps during link cap retrieval (George Shen)
- drm/amd/display: Fix BT2020 YCbCr limited/full range input (Ilya Bakoulin)
- drm/amd/display: Guard against setting dispclk low when active (Nicholas Kazlauskas)
- drm/amd/display: Add support for disconnected eDP streams (Harry Vanzylldejong)
- drm/amd/pm: Fetch current power limit from PMFW (Lijo Lazar)
- irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector (Anup Patel)
- eeprom: ee1004: Check chip before probing (Eddie James)
- mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs (Chris Morgan)
- i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA) (Frank Li)
- EDAC/ie31200: work around false positive build warning (Arnd Bergmann)
- power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree (Chris Morgan)
- net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [Orabug: 38095024] {CVE-2025-38061}
- wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU (Kuan-Chung Chen)
- wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware (Ping-Ke Shih)
- wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32() (Ping-Ke Shih)
- wifi: rtw89: fw: propagate error code from rtw89_h2c_tx() (Ping-Ke Shih)
- wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU (Bitterblue Smith)
- PCI: epf-mhi: Update device ID for SA8775P (Mrinmay Sarkar)
- clocksource: mips-gic-timer: Enable counter when CPUs start (Paul Burton)
- MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core (Paul Burton)
- genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (Jason Gunthorpe) [Orabug: 38095031] {CVE-2025-38062}
- x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op() (Uros Bizjak)
- drm/amdgpu: remove all KFD fences from the BO on release (Christian König)
- MIPS: Use arch specific syscall name match function (Bibo Mao)
- drm/xe/oa: Ensure that polled read returns latest data (Umesh Nerlige Ramappa)
- net: ipv6: Init tunnel link-netns before registering dev (Xiao Liang)
- crypto: skcipher - Zap type in crypto_alloc_sync_skcipher (Herbert Xu)
- crypto: ahash - Set default reqsize from ahash_alg (Herbert Xu)
- x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh)
- net/mlx5: Change POOL_NEXT_SIZE define value and make it global (Patrisious Haddad)
- scsi: scsi_debug: First fixes for tapes (Kai Mäkisara)
- dm: fix unconditional IO throttle caused by REQ_PREFLUSH (Jinliang Zheng) [Orabug: 38095038] {CVE-2025-38063}
- libbpf: Fix out-of-bound read (Nandakumar Edamana)
- loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize (Christoph Hellwig)
- net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode (Jianbo Liu)
- media: tc358746: improve calculation of the D-PHY timing registers (Matthias Fend)
- media: adv7180: Disable test-pattern control on adv7180 (Niklas Söderlund)
- cpuidle: menu: Avoid discarding useful information (Rafael J. Wysocki)
- vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines (Konstantin Shkolnyy)
- x86/nmi: Add an emergency handler in nmi_desc &amp; use it in nmi_shootdown_cpus() (Waiman Long)
- ASoC: mediatek: mt8188: Add reference for dmic clocks (Nícolas F R A Prado)
- ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile (Nícolas F R A Prado)
- drm/amd/display: Fix mismatch type comparison (Navid Assadian)
- drm/amd/display: fix dcn4x init failed (Charlene Liu)
- drm/amd/display: handle max_downscale_src_width fail check (Yihan Zhu)
- x86/build: Fix broken copy command in genimage.sh when making isoimage (Nir Lichtman)
- Octeontx2-af: RPM: Register driver with PCI subsys IDs (Hariprasad Kelam)
- bpf: Search and add kfuncs in struct_ops prologue and epilogue (Amery Hung)
- soc: ti: k3-socinfo: Do not use syscon helper to build regmap (Andrew Davis)
- wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band (Ramasamy Kaliappan)
- bonding: report duplicate MAC address in all situations (Hangbin Liu)
- net: xgene-v2: remove incorrect ACPI_PTR annotation (Arnd Bergmann)
- net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only (Eric Woudstra)
- leds: pwm-multicolor: Add check for fwnode_property_read_u32 (Yuanjun Gong)
- drm/xe: xe_gen_wa_oob: replace program_invocation_short_name (Daniel Gomez)
- drm/amdkfd: KFD release_work possible circular locking (Philip Yang)
- pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf (Inochi Amaoto)
- selftests/net: have `gro.sh -t` return a correct exit code (Kevin Krakauer)
- net/mlx5: Avoid report two health errors on same syndrome (Moshe Shemesh)
- drm/xe/pf: Create a link between PF and VF devices (K V P Satyanarayana)
- drm/xe/vf: Retry sending MMIO request to GUC on timeout error (K V P Satyanarayana)
- firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar) [Orabug: 38094925] {CVE-2025-38043}
- PCI: brcmstb: Add a softdep to MIP MSI-X driver (Stanimir Varbanov)
- PCI: brcmstb: Expand inbound window size up to 64GB (Stanimir Varbanov)
- wifi: ath12k: Report proper tx completion status to mac80211 (Vinith Kumar R)
- soc: apple: rtkit: Implement OSLog buffers properly (Hector Martin)
- soc: apple: rtkit: Use high prio work queue (Janne Grunau)
- perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters (Rob Herring)
- fpga: altera-cvp: Increase credit timeout (Kuhanh Murugasen Krishnan)
- drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence (AngeloGioacchino Del Regno)
- ARM: at91: pm: fix at91_suspend_finish for ZQ calibration (Li Bin)
- hwmon: (gpio-fan) Add missing mutex locks (Alexander Stein)
- x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Breno Leitao)
- clk: imx8mp: inform CCF of maximum frequency of clocks (Ahmad Fatoum)
- media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value (Ricardo Ribalda)
- media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map (Ricardo Ribalda)
- ublk: complete command synchronously on error (Caleb Sander)
- block: mark bounce buffering as incompatible with integrity (Christoph Hellwig)
- drm/rockchip: vop2: Add uv swap for cluster window (Andy Yan)
- ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). (Kuniyuki Iwashima)
- scsi: logging: Fix scsi_logging_level bounds (Nicolas Bouchinet)
- ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7 (Maciej S. Szmigiero)
- perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (Saket Kumar Bhaskar)
- net: pktgen: fix mpls maximum labels list parsing (Peter Seiderer)
- media: imx335: Set vblank immediately (Paul Elder)
- iommufd: Disallow allocating nested parent domain with fault ID (Yi Liu)
- ublk: enforce ublks_max only for unprivileged devices (Uday Shankar)
- dpll: Add an assertion to check freq_supported_num (Jiasheng Jiang)
- net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104 (Andrei Botila)
- net: ethernet: ti: cpsw_new: populate netdev of_node (Alexander Sverdlin)
- rcu: Fix get_state_synchronize_rcu_full() GP-start detection (Paul E. McKenney)
- pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" (Artur Weber)
- media: cx231xx: set device_caps for 417 (Hans Verkuil) [Orabug: 38094934] {CVE-2025-38044}
- perf/core: Clean up perf_try_init_event() (Peter Zijlstra)
- drm/amd/display: Request HW cursor on DCN3.2 with SubVP (Aric Cyr)
- drm/amd/display: Fix p-state type when p-state is unsupported (Dillon Varone)
- drm/amd/display: Fix DMUB reset sequence for DCN401 (Dillon Varone)
- drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination (George Shen)
- drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35 (Nicholas Kazlauskas)
- drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c (Victor Lu)
- remoteproc: qcom_wcnss: Handle platforms with only single power domain (Matti Lehtimäki)
- blk-throttle: don't take carryover for prioritized processing of metadata (Ming Lei)
- net: phylink: use pl-&gt;link_interface in phylink_expects_phy() (Choong Yong Liang)
- drm/gem: Test for imported GEM buffers with helper (Thomas Zimmermann)
- orangefs: Do not truncate file size (Matthew Wilcox) [Orabug: 38095056] {CVE-2025-38065}
- soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables (AngeloGioacchino Del Regno)
- dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [Orabug: 38095063] {CVE-2025-38066}
- usb: xhci: set page size to the xHCI-supported size (Niklas Neronin)
- media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() (Markus Elfring)
- ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 (Svyatoslav Ryhel)
- soc: samsung: include linux/array_size.h where needed (Arnd Bergmann)
- drm/xe: Retry BO allocation (Matthew Brost)
- drm/xe: Nuke VM's mapping upon close (Matthew Brost)
- ieee802154: ca8210: Use proper setters and getters for bitwise types (Andy Shevchenko)
- rtc: ds1307: stop disabling alarms on probe (Alexandre Belloni)
- tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() (Eric Dumazet)
- ALSA: seq: Improve data consistency at polling (Takashi Iwai)
- powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 (Andreas Schwab)
- arm64: tegra: Resize aperture for the IGX PCIe C5 slot (Jonathan Hunter)
- arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator (Diogo Ivo)
- drm/amdgpu: Fix missing drain retry fault the last entry (Emily Deng)
- drm/amdkfd: Set per-process flags only once cik/vi (Harish Kasiviswanathan)
- drm/amdkfd: Set per-process flags only once for gfx9/10/11/12 (Harish Kasiviswanathan)
- crypto: mxs-dcp - Only set OTP_KEY bit for OTP key (Sven Schwermer)
- crypto: lzo - Fix compression buffer overrun (Herbert Xu) [Orabug: 38095079] {CVE-2025-38068}
- misc: pci_endpoint_test: Give disabled BARs a distinct error code (Niklas Cassel)
- PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops (Christian Bruel) [Orabug: 38095087] {CVE-2025-38069}
- watchdog: aspeed: Update bootstatus handling (Chin-Ting Kuo)
- cpufreq: tegra186: Share policy per cluster (Aaron Kling)
- iommu/amd/pgtbl_v2: Improve error handling (Vasant Hegde)
- coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t (Levi Yun)
- badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable &lt; 0 (Coly Li)
- ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup() (Alexey Klimov)
- auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" (Andy Shevchenko)
- gfs2: Check for empty queue in run_queue (Andreas Gruenbacher)
- drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch (Leon Huang)
- drm/amd/display: not abort link train when bw is low (Peichen Huang)
- drm/amd/display: calculate the remain segments for all pipes (Zhikai Zhai)
- drm/amd/display: remove minimum Dispclk and apply oem panel timing. (Charlene Liu)
- ipv6: save dontfrag in cork (Willem de Bruijn)
- wifi: cfg80211: allow IR in 20 MHz configurations (Anjaneyulu)
- wifi: mac80211_hwsim: Fix MLD address translation (Ilan Peer)
- wifi: mac80211: fix warning on disconnect during failed ML reconf (Johannes Berg)
- wifi: iwlwifi: fix the ECKV UEFI variable name (Emmanuel Grumbach)
- wifi: iwlwifi: mark Br device not integrated (Johannes Berg)
- wifi: iwlwifi: fix debug actions order (Johannes Berg) [Orabug: 38094942] {CVE-2025-38045}
- wifi: iwlwifi: w/a FW SMPS mode selection (Daniel Gabay)
- wifi: iwlwifi: don't warn when if there is a FW error (Miri Korenblit)
- printk: Check CON_SUSPEND when unblanking a console (Marcos Paulo de Souza)
- iommu: Keep dev-&gt;iommu state consistent (Robin Murphy)
- hwmon: (dell-smm) Increment the number of fans (Kurt Borja)
- wifi: iwlwifi: mvm: fix setting the TK when associated (Avraham Stern)
- usb: xhci: Don't change the status of stalled TDs on failed Stop EP (Michał Pecio)
- mmc: sdhci: Disable SD card clock before changing parameters (Erick Shepherd)
- mmc: dw_mmc: add exynos7870 DW MMC support (Kaustabh Chakraborty)
- arm64/mm: Check PUD_TYPE_TABLE in pud_bad() (Ryan Roberts)
- arm64/mm: Check pmd_table() in pmd_trans_huge() (Ryan Roberts)
- phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set (Andy Yan)
- PNP: Expand length of fixup id string (Kees Cook)
- netfilter: conntrack: Bound nf_conntrack sysctl writes (Nicolas Bouchinet)
- wifi: rtw89: set force HE TB mode when connecting to 11ax AP (Dian-Syuan Yang)
- timer_list: Don't use %pK through printk() (Thomas Weißschuh)
- net: hsr: Fix PRP duplicate detection (Jaakko Karrenpalo)
- net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe (Jonas Karlman)
- posix-timers: Ensure that timer initialization is fully visible (Thomas Gleixner)
- posix-timers: Add cond_resched() to posix_timer_add() search loop (Eric Dumazet)
- RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() (Maher Sanalla)
- ext4: do not convert the unwritten extents if data writeback fails (Baokun Li)
- ext4: reject the 'data_err=abort' option in nojournal mode (Baokun Li)
- clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490 (Taniya Das)
- ASoC: sun4i-codec: support hp-det-gpios property (Ryan Walklin)
- drm/amdgpu: Update SRIOV video codec caps (David Rosca)
- drm/amdgpu/gfx11: don't read registers in mqd init (Alex Deucher)
- drm/amdgpu/gfx12: don't read registers in mqd init (Alex Deucher)
- mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check (Shree Ramamoorthy)
- pinctrl-tegra: Restore SFSEL bit when freeing pins (Prathamesh Shete)
- xen: Add support for XenServer 6.1 platform device (Frediano Ziglio)
- net/smc: use the correct ndev to find pnetid by pnetid table (Guangguan Wang)
- dm: restrict dm device size to 2^63-512 bytes (Mikulas Patocka)
- crypto: octeontx2 - suppress auth failure screaming due to negative tests (Shashank Gupta)
- kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf (Masahiro Yamada)
- kbuild: fix argument parsing in scripts/config (Seyediman Seyedarab)
- bpf: Allow pre-ordering for bpf cgroup progs (Yonghong Song)
- ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect (Nícolas F R A Prado)
- ASoC: pcm6240: Drop bogus code handling IRQ as GPIO (Linus Walleij)
- spi: spi-mux: Fix coverity issue, unchecked return value (Sergio Perez Gonzalez)
- erofs: initialize decompression early (Gao Xiang)
- thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer (Mika Westerberg)
- objtool: Fix error handling inconsistencies in check() (Josh Poimboeuf)
- rtc: rv3032: fix EERD location (Alexandre Belloni)
- tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() (Ilpo Järvinen)
- jbd2: do not try to recover wiped journal (Jan Kara)
- PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off() (Frank Li)
- bpf: Return prog btf_id without capable check (Mykyta Yatsenko)
- vfio/pci: Handle INTx IRQ_NOTCONNECTED (Alex Williamson)
- scsi: st: ERASE does not change tape location (Kai Mäkisara)
- scsi: st: Tighten the page format heuristics with MODE SELECT (Kai Mäkisara)
- hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure (Al Viro)
- ext4: reorder capability check last (Christian Göttsche)
- riscv: Call secondary mmu notifier when flushing the tlb (Alexandre Ghiti)
- bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set (Shantiprasad Shettar)
- wifi: mwifiex: Fix HT40 bandwidth issue. (Jeff Chen)
- um: Update min_low_pfn to match changes in uml_reserved (Tiwei Bie)
- um: Store full CSGSFS and SS register from mcontext (Benjamin Berg)
- clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug (Nick Hu)
- dlm: make tcp still work in multi-link env (Heming Zhao)
- s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste() (Heiko Carstens)
- i3c: master: svc: Fix missing STOP for master request (Stanley Chu)
- drm/amdgpu: adjust drm_firmware_drivers_only() handling (Alex Deucher)
- drm/amd/display: Guard against setting dispclk low for dcn31x (Jing Zhou)
- drm/amdgpu: release xcp_mgr on exit (Flora Cui)
- blk-cgroup: improve policy registration error handling (Chen Linxuan)
- btrfs: send: return -ENAMETOOLONG when attempting a path that is too long (Filipe Manana)
- btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work() (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to async workers (Filipe Manana)
- btrfs: run btrfs_error_commit_super() early (Qu Wenruo)
- btrfs: avoid linker error in btrfs_find_create_tree_block() (Mark Harmstone)
- btrfs: make btrfs_discard_workfn() block_group ref explicit (Boris Burkov)
- i2c: pxa: fix call balance of i2c-&gt;clk handling routines (Vitalii Mordan)
- i2c: qup: Vote for interconnect bandwidth to DRAM (Stephan Gerhold)
- x86/mm: Check return value from memblock_phys_alloc_range() (Philip Redkin) [Orabug: 38095101] {CVE-2025-38071}
- x86/microcode: Update the Intel processor flag scan check (Sohil Mehta)
- x86/smpboot: Fix INIT delay assignment for extended Intel Families (Sohil Mehta)
- x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP (Ingo Molnar)
- x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers (Thomas Huth)
- wifi: mt76: mt7925: fix fails to enter low power mode in suspend state (Quan Zhou)
- wifi: mt76: mt7925: load the appropriate CLC data based on hardware type (Ming Yen Hsieh)
- wifi: mt76: mt7996: revise TXS size (Benjamin Lin)
- wifi: mt76: mt7996: fix SER reset trigger on WED reset (Rex Lu)
- wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 (Felix Fietkau)
- cgroup/rstat: avoid disabling irqs for O(num_cpu) (Eric Dumazet)
- drm/amdgpu: Skip pcie_replay_count sysfs creation for VF (Victor Skvortsov)
- mmc: host: Wait for Vdd to settle on card power off (Erick Shepherd)
- staging: vchiq_arm: Create keep-alive thread during probe (Stefan Wahren)
- pidfs: improve multi-threaded exec and premature thread-group leader exit polling (Christian Brauner)
- libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [Orabug: 38095109] {CVE-2025-38072}
- ext4: on a remount, only log the ro or r/w state when it has changed (Nicolas Bretz)
- xen/pci: Do not register devices with segments &gt;= 0x10000 (Roger Pau Monné)
- PCI: vmd: Disable MSI remapping bypass under Xen (Roger Pau Monné)
- drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12 (Jonathan Kim)
- drm/amdgpu/discovery: check ip_discovery fw file available (Flora Cui)
- pNFS/flexfiles: Report ENETDOWN as a connection error (Trond Myklebust)
- tools/build: Don't pass test log files to linker (Ian Rogers)
- r8169: disable RTL8126 ZRX-DC timeout (Chunhao Lin)
- PCI: dwc: ep: Ensure proper iteration over outbound map windows (Frank Li)
- objtool: Properly disable uaccess validation (Josh Poimboeuf)
- lockdep: Fix wait context check on softirq for PREEMPT_RT (Ryo Takakura)
- dql: Fix dql-&gt;limit value when reset. (Jing Su)
- Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken (Pedro Nishiyama)
- Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal (Sean Wang)
- thermal/drivers/qoriq: Power down TMU on system suspend (Alice Guo)
- thermal/drivers/mediatek/lvts: Start sensor interrupts disabled (Nícolas F R A Prado)
- net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus (Hans-Frieder Vogt)
- net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards (Hans-Frieder Vogt)
- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (Daniel Hsu)
- ASoC: codecs: wsa883x: Correct VI sense channel mask (Krzysztof Kozlowski)
- ASoC: codecs: wsa884x: Correct VI sense channel mask (Krzysztof Kozlowski)
- spi-rockchip: Fix register out of bounds access (Luis de Arquer) [Orabug: 38095173] {CVE-2025-38081}
- SUNRPC: rpcbind should never reset the port to the value '0' (Trond Myklebust)
- SUNRPC: rpc_clnt_set_transport() must not change the autobind setting (Trond Myklebust)
- NFSv4: Treat ENETUNREACH errors as fatal for state recovery (Trond Myklebust)
- cifs: Fix establishing NetBIOS session for SMB2+ connection (Pali Rohár)
- cifs: add validation check for the fields in smb_aces (Namjae Jeon)
- cifs: Set default Netbios RFC1001 server name to hostname in UNC (Pali Rohár)
- fbdev: core: tileblit: Implement missing margin clearing for tileblit (Zsolt Kajtar)
- fbcon: Use correct erase colour for clearing in fbcon (Zsolt Kajtar)
- fbdev: fsl-diu-fb: add missing device_remove_file() (Shixiong Ou)
- riscv: Allow NOMMU kernels to access all of RAM (Samuel Holland)
- mailbox: use error ret code of of_parse_phandle_with_args() (Tudor Ambarus)
- mailbox: pcc: Use acpi_os_ioremap() instead of ioremap() (Sudeep Holla)
- tpm: Convert warn to dbg in tpm2_start_auth_session() (Jonathan Mcdowell)
- ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list (Diogo Ivo)
- tracing: Mark binary printing functions with __printf() attribute (Andy Shevchenko)
- iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability (Yi Liu)
- arm64: Add support for HIP09 Spectre-BHB mitigation (Jinqian Yang)
- SUNRPC: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFS: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Trond Myklebust)
- io_uring/msg: initialise msg request opcode (Pavel Begunkov)
- exfat: call bh_read in get_block only when necessary (Sungjong Seo)
- fuse: Return EPERM rather than ENOSYS from link() (Matt Johnston)
- smb: client: Store original IO parameters and prevent zero IO sizes (Zhaolong Wang)
- cifs: Fix negotiate retry functionality (Pali Rohár)
- cifs: Fix querying and creating MF symlinks over SMB1 (Pali Rohár)
- cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES (Pali Rohár)
- s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log (Tony Krowiak)
- x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li) [Orabug: 38094951] {CVE-2025-38047}
- kconfig: merge_config: use an empty file as initfile (Daniel Gomez)
- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (Haoran Jiang)
- bpf: fix possible endless loop in BPF map iteration (Brandon Kammerdiener)
- io_uring: don't duplicate flushing in io_req_post_cqe (Pavel Begunkov)
- block: fix race between set_blocksize and read paths (Darrick J. Wong) [Orabug: 38095117] {CVE-2025-38073}
- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (Ihor Solodrai)
- drm/amdgpu: Allow P2P access through XGMI (Felix Kuehling)
- drm/amd/display: Enable urgent latency adjustment on DCN35 (Nicholas Susanto)
- fs/ext4: use sleeping version of sb_find_get_block() (Davidlohr Bueso)
- fs/jbd2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/ocfs2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: introduce sleeping flavors for pagecache lookups (Davidlohr Bueso)
- fs/buffer: split locking for pagecache lookups (Davidlohr Bueso)
- ima: process_measurement() needlessly takes inode_lock() on MAY_READ (Frederick Lawler)
- dma-mapping: Fix warning reported for missing prototype (Balbir Singh)
- net: enetc: refactor bulk flipping of RX buffers to separate function (Vladimir Oltean)
- vhost_task: fix vhost_task_create() documentation (Stefano Garzarella)
- cgroup: Fix compilation issue due to cgroup_mutex not being exported (Gao Xu)
- dma-mapping: avoid potential unused data compilation warning (Marek Szyprowski)
- mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type (Hans de Goede)
- intel_th: avoid using deprecated page-&gt;mapping, index fields (Lorenzo Stoakes)
- dma/mapping.c: dev_dbg support for dma_addressing_limited (Balbir Singh)
- virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han) [Orabug: 38094958] {CVE-2025-38048}
- scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices (Manish Pandey)
- scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [Orabug: 38095134] {CVE-2025-38075}
- nvmem: qfprom: switch to 4-byte aligned reads (Dmitry Baryshkov)
- nvmem: core: update raw_len if the bit reading is required (Dmitry Baryshkov)
- nvmem: core: verify cell's raw_len (Dmitry Baryshkov)
- nvmem: core: fix bit offsets of more than one byte (Dmitry Baryshkov)
- nvmem: rockchip-otp: add rk3576 variant data (Heiko Stuebner)
- nvmem: rockchip-otp: Move read-offset into variant-data (Heiko Stuebner)
- cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist (Pengyu Luo)
- phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Move IRQ request in probe (Claudiu Beznea)
- i2c: designware: Fix an error handling path in i2c_dw_pci_probe() (Christophe Jaillet)
- i2c: designware: Use temporary variable for struct device (Andy Shevchenko)
- drm/amd/display: Defer BW-optimization-blocked DRR adjustments (John Olender)
- drm/amd/display: Correct timing_adjust_pending flag setting. (Zhongwei)
- drm/amd/display: Do not enable replay when vtotal update is pending. (Sung-Huai Wang)
- drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401 (Dillon Varone)
- LTS version: v6.12.30 (Jack Vogel)
- drm/amdgpu: fix pm notifier handling (Alex Deucher)
- phy: tegra: xusb: remove a stray unlock (Dan Carpenter)
- usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977018] {CVE-2025-37967}
- drm/tiny: panel-mipi-dbi: Use drm_client_setup_with_fourcc() (Fabio Estevam)
- drm/panel-mipi-dbi: Run DRM default client setup (Thomas Zimmermann)
- drm/fbdev-dma: Support struct drm_driver.fbdev_probe (Thomas Zimmermann)
- Bluetooth: btnxpuart: Fix kernel panic during FW release (Neeraj Sanjay Kale) [Orabug: 37844459] {CVE-2025-22102}
- iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977026] {CVE-2025-37968}
- accel/ivpu: Fix fw log printing (Jacek Lawrynowicz)
- accel/ivpu: Refactor functions in ivpu_fw_log.c (Jacek Lawrynowicz)
- accel/ivpu: Reset fw log on cold boot (Tomasz Rusinowicz)
- accel/ivpu: Rename ivpu_log_level to fw_log_level (Jacek Lawrynowicz)
- mm/page_alloc: fix race condition in unaccepted memory handling (Kirill A. Shutemov) [Orabug: 38094767] {CVE-2025-38008}
- drm/xe/gsc: do not flush the GSC worker from the reset path (Daniele Ceraolo Spurio)
- CIFS: New mount option for cifs.upcall namespace resolution (Ritvik Budhiraja)
- dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (Shuai Xue) [Orabug: 38094790] {CVE-2025-38014}
- dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094793] {CVE-2025-38015}
- dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call (Shuai Xue)
- dmaengine: idxd: Add missing cleanups in cleanup internals (Shuai Xue)
- dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs (Shuai Xue)
- dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy (Yemike Abhilash Chandra)
- dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094756] {CVE-2025-38005}
- mm: userfaultfd: correct dirty flags set for both present and swap pte (Barry Song)
- net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
- ring-buffer: Fix persistent buffer when commit page is the reader page (Steven Rostedt)
- wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094770] {CVE-2025-38009}
- tpm: Mask TPM RC in tpm2_start_auth_session() (Jarkko Sakkinen)
- spi: tegra114: Use value to check for invalid delays (Aaron Kling)
- smb: client: fix memory leak during error handling for POSIX mkdir (Jethro Donaldson)
- scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer (Steve Siwinski)
- phy: renesas: rcar-gen3-usb2: Set timing registers only once (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind (Claudiu Beznea)
- phy: Fix error handling in tegra_xusb_port_init (Ma Ke)
- phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking (Wayne Chang) [Orabug: 38094777] {CVE-2025-38010}
- tracing: samples: Initialize trace_array_printk() with the correct function (Steven Rostedt)
- ftrace: Fix preemption accounting for stacktrace filter command (Donglin Peng)
- ftrace: Fix preemption accounting for stacktrace trigger command (Donglin Peng)
- kbuild: Disable -Wdefault-const-init-unsafe (Nathan Chancellor)
- Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer() (Michael Kelley)
- Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (Michael Kelley)
- arm64: dts: rockchip: Remove overdrive-mode OPPs from RK3588J SoC dtsi (Dragan Simic)
- arm64: dts: amlogic: dreambox: fix missing clkc_audio node (Christian Hewitt)
- hv_netvsc: Remove rmsg_pgcnt (Michael Kelley)
- hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (Michael Kelley)
- hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (Michael Kelley)
- dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi)
- ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera (Nicolas Chauvet)
- ALSA: usb-audio: Add sample rate quirk for Audioengine D1 (Christian Heusel)
- ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() (Xu Wang)
- ACPI: PPTT: Fix processor subtable walk (Jeremy Linton)
- gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
- MAINTAINERS: Update Alexey Makhalov's email address (Alexey Makhalov)
- drm/amd/display: Avoid flooding unnecessary info messages (Wayne Lin)
- drm/amd/display: Correct the reply value when AUX write incomplete (Wayne Lin)
- drm/amdgpu: csa unmap use uninterruptible lock (Philip Yang) [Orabug: 38094779] {CVE-2025-38011}
- drm/amdgpu: fix incorrect MALL size for GFX1151 (Tim Huang)
- Revert "drm/amd/display: Hardware cursor changes color when switched to software cursor" (Melissa Wen)
- btrfs: add back warning for mount option commit values exceeding 300 (Kyoji Ogasawara)
- btrfs: fix folio leak in submit_one_async_extent() (Boris Burkov)
- btrfs: fix discard worker infinite loop after disabling discard (Filipe Manana)
- LoongArch: uprobes: Remove redundant code about resume_era (Tiezhu Yang)
- LoongArch: uprobes: Remove user_{en,dis}able_single_step() (Tiezhu Yang)
- LoongArch: Fix MAX_REG_OFFSET calculation (Huacai Chen)
- LoongArch: Save and restore CSR.CNTC for hibernation (Huacai Chen)
- LoongArch: Move __arch_cpu_idle() to .cpuidle.text section (Huacai Chen)
- LoongArch: Prevent cond_resched() occurring within kernel-fpu (Tianyang Zhang)
- HID: bpf: abort dispatch if device destroyed (Rongrong) [Orabug: 38094796] {CVE-2025-38016}
- udf: Make sure i_lenExtents is uptodate on inode eviction (Jan Kara)
- sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator (Tejun Heo) [Orabug: 38094786] {CVE-2025-38012}
- dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" (Nathan Lynch)
- NFSv4/pnfs: Reset the layout state after a layoutreturn (Trond Myklebust)
- tsnep: fix timestamping with a stacked DSA driver (Gerhard Engleder)
- net/tls: fix kernel panic when alloc_page failed (Pengtao He) [Orabug: 38094802] {CVE-2025-38018}
- mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (Ido Schimmel) [Orabug: 38094804] {CVE-2025-38019}
- wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request (Kees Cook) [Orabug: 38094788] {CVE-2025-38013}
- octeontx2-pf: Do not reallocate all ntuple filters (Subbaraya Sundeep)
- octeontx2-af: Fix CGX Receive counters (Hariprasad Kelam)
- net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability (Bc-Bocun Chen)
- octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy (Subbaraya Sundeep)
- netlink: specs: tc: all actions are indexed arrays (Jakub Kicinski)
- netlink: specs: tc: fix a couple of attribute names (Jakub Kicinski)
- drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value (Umesh Nerlige Ramappa)
- regulator: max20086: fix invalid memory access (Cosmin Tanislav) [Orabug: 38094833] {CVE-2025-38027}
- qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() (Abdun Nihaal)
- net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094808] {CVE-2025-38020}
- vsock/test: Fix occasional failure in SIOCOUTQ tests (Konstantin Shkolnyy)
- net: dsa: b53: prevent standalone from trying to forward to other ports (Jonas Gorski)
- ALSA: sh: SND_AICA should depend on SH_DMA_API (Geert Uytterhoeven)
- nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (Keith Busch)
- nvme-pci: make nvme_pci_npages_prp() __always_inline (Kees Cook)
- net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING (Vladimir Oltean)
- net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe)
- ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info (Takashi Iwai)
- ALSA: seq: Fix delivery of UMP events to group ports (Takashi Iwai)
- net: mctp: Ensure keys maintain only one ref to corresponding dev (Andrew Jeffery)
- tests/ncdevmem: Fix double-free of queue array (Cosmin Ratiu)
- selftests: ncdevmem: Switch to AF_INET6 (Stanislav Fomichev)
- selftests: ncdevmem: Make client_ip optional (Stanislav Fomichev)
- selftests: ncdevmem: Unify error handling (Stanislav Fomichev)
- selftests: ncdevmem: Separate out dmabuf provider (Stanislav Fomichev)
- selftests: ncdevmem: Redirect all non-payload output to stderr (Stanislav Fomichev)
- net: mctp: Don't access ifa_index when missing (Matt Johnston)
- mctp: no longer rely on net-&gt;dev_index_head[] (Eric Dumazet)
- tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing (Hangbin Liu)
- net_sched: Flush gso_skb list too during -&gt;change() (Cong Wang) [Orabug: 37998128] {CVE-2025-37992}
- Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags (Luiz Augusto von Dentz)
- RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Zhu Yanjun) [Orabug: 38094813] {CVE-2025-38022}
- spi: loopback-test: Do not split 1024-byte hexdumps (Geert Uytterhoeven)
- nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094818] {CVE-2025-38023}
- HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 38094764] {CVE-2025-38007}
- HID: thrustmaster: fix memory leak in thrustmaster_interrupts() (Qasim Ijaz)
- RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094827] {CVE-2025-38024}
- virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx (Koichiro Den)
- virtio_ring: add a func argument 'recycle_done' to virtqueue_reset() (Koichiro Den)
- iio: chemical: sps30: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7768-1: Fix insufficient alignment of timestamp. (Jonathan Cameron)
- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
- xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
- Revert "drm/amd: Stop evicting resources on APUs in suspend" (Alex Deucher)
- drm/amd: Add Suspend/Hibernate notification callback support (Mario Limonciello)
- iio: pressure: mprls0025pa: use aligned_s64 for timestamp (David Lechner)
- iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7266: Fix potential timestamp alignment issue. (Jonathan Cameron)
- KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (Sean Christopherson)
- KVM: Add member to struct kvm_gfn_range to indicate private/shared (Isaku Yamahata)
- uio_hv_generic: Fix sysfs creation path for ring buffer (Naman Jain)
- tpm: tis: Double the timeout B to 4s (Michal Suchanek)
- tracing: probes: Fix a possible race in trace_probe_log APIs (Masami Hiramatsu)
- cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks (Waiman Long)
- arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout (Himanshu Bhavani)
- platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection (Hans de Goede)
- platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL) (Runhua He)
- binfmt_elf: Move brk for static PIE even if ASLR disabled (Kees Cook)
- riscv: dts: sophgo: fix DMA data-width configuration for CV18xx (Ze Huang)
- drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies (Mario Limonciello)
- drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC Policies (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list to always include security.* xattrs (Stephen Smalley)
- arm64: dts: rockchip: Assign RT5616 MCLK rate on rk3588-friendlyelec-cm3588 (Tom Vincent)
- LTS version: v6.12.29 (Jack Vogel)
- arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977004] {CVE-2025-37963}
- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976926] {CVE-2025-37948}
- arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
- arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
- arm64: insn: Add support for encoding DSB (James Morse)
- mm: page_alloc: speed up fallbacks in rmqueue_bulk() (Johannes Weiner)
- mm: page_alloc: don't steal single pages from biggest buddy (Johannes Weiner)
- Bluetooth: btmtk: Remove the resetting step before downloading the fw (Hao Qin)
- Bluetooth: btmtk: Remove resetting mt7921 before downloading the fw (Hao Qin)
- io_uring: always arm linked timeouts prior to issue (Jens Axboe)
- rust: clean Rust 1.88.0's `clippy::uninlined_format_args` lint (Miguel Ojeda)
- rust: allow Rust 1.87.0's `clippy::ptr_eq` lint (Miguel Ojeda)
- Revert "um: work around sched_yield not yielding in time-travel mode" (Christian Lamparter)
- do_umount(): add missing barrier before refcount checks in sync case (Al Viro)
- io_uring/sqpoll: Increase task_work submission batch size (Gabriel Krisman Bertazi)
- drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs (Tejas Upadhyay)
- drm/xe/tests/mocs: Update xe_force_wake_get() return handling (Himal Prasad Ghimiray)
- riscv: misaligned: enable IRQs while handling misaligned accesses (Clément Léger)
- riscv: misaligned: factorize trap handling (Clément Léger)
- nvme: unblock ctrl state transition for firmware update (Daniel Wagner)
- drm/panel: simple: Update timings for AUO G101EVN010 (Kevin Baker)
- loop: Add sanity check for read/write_iter (Lizhi Xu)
- loop: factor out a loop_assign_backing_file helper (Christoph Hellwig)
- loop: refactor queue limits updates (Christoph Hellwig)
- loop: Fix ABBA locking race (Ogawa Hirofumi)
- loop: Simplify discard granularity calc (John Garry)
- loop: Use bdev limit helpers for configuring discard (John Garry)
- riscv: misaligned: Add handling for ZCB instructions (Nylon Chen)
- MIPS: Fix MAX_REG_OFFSET (Thorsten Blum)
- iio: adc: dln2: Use aligned_s64 for timestamp (Jonathan Cameron)
- iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64 (Jonathan Cameron)
- types: Complement the aligned types with signed 64-bit one (Andy Shevchenko)
- iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer. (Jonathan Cameron)
- iio: accel: adxl367: fix setting odr for activity time update (Lothar Rubusch)
- usb: usbtmc: Fix erroneous generic_read ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous wait_srq ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous get_stb ioctl error returns (Dave Penkler)
- USB: usbtmc: use interruptible sleep in usbtmc_read (Oliver Neukum)
- usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015126] {CVE-2025-37994}
- usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition (Rd Babiera)
- usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs (Lukasz Czechowski)
- usb: host: tegra: Prevent host controller crash when OTG port is used (Jim Lin)
- usb: gadget: Use get_status callback to set remote wakeup capability (Prashanth K)
- usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN (Wayne Chang)
- usb: gadget: f_ecm: Add get_status callback (Prashanth K)
- usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version (Pawel Laszczak)
- usb: cdnsp: Fix issue with resuming from L1 (Pawel Laszczak)
- usb: dwc3: gadget: Make gadget_wakeup asynchronous (Prashanth K)
- x86/microcode: Consolidate the loader enablement checking (Borislav Petkov)
- module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015131] {CVE-2025-37995}
- memblock: Accept allocated memory before use in memblock_double_array() (Tom Lendacky) [Orabug: 37976994] {CVE-2025-37960}
- clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() (Sebastian Andrzej Siewior)
- arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong idmap generation (Levi Yun)
- accel/ivpu: Increase state dump msg timeout (Jacek Lawrynowicz)
- xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976934] {CVE-2025-37949}
- xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it (John Ernberg)
- smb: client: Avoid race in open_cached_dir with lease breaks (Paul Aurich) [Orabug: 37976959] {CVE-2025-37954}
- usb: uhci-platform: Make the clock really optional (Alexey Charkov)
- drm/amdgpu/hdp7: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amd/display: Copy AUX read reply data whenever length &gt; 0 (Wayne Lin)
- drm/amd/display: Fix wrong handling for AUX_DEFER case (Wayne Lin)
- drm/amd/display: Remove incorrect checking in dmub aux handler (Wayne Lin)
- drm/amd/display: Fix the checking condition in dmub aux handling (Wayne Lin)
- drm/amd/display: more liberal vmin/vmax update for freesync (Aurabindo Pillai)
- drm/amd/display: Fix invalid context error in dml helper (Roman Li) [Orabug: 37977185] {CVE-2025-37965}
- drm/amdgpu/vcn: using separate VCN1_AON_SOC offset (Ruijing Dong)
- drm/xe: Add page queue multiplier (Matthew Brost)
- drm/v3d: Add job to pending list if the reset was skipped (Maíra Canal) [Orabug: 37976942] {CVE-2025-37951}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug: 37977031] {CVE-2025-37969}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977037] {CVE-2025-37970}
- iio: imu: inv_mpu6050: align buffer for timestamp (David Lechner)
- iio: adis16201: Correct inclinometer channel resolution (Gabriel)
- iio: adc: rockchip: Fix clock initialization sequence (Simon Xue)
- iio: adc: ad7606: fix serial register access (Angelo Dureghello)
- io_uring: ensure deferred completions are flushed for multishot (Jens Axboe)
- drm/amd/display: Shift DMUB AUX reply command if necessary (Wayne Lin)
- KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (Mikhail Lobanov) [Orabug: 37976977] {CVE-2025-37957}
- selftests/mm: fix a build failure on powerpc (Nysal Jan K.A.)
- selftests/mm: compaction_test: support platform with huge mount of memory (Feng Tang)
- mm/userfaultfd: fix uninitialized output field for -EAGAIN race (Peter Xu)
- mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976982] {CVE-2025-37958}
- mm: fix folio_pte_batch() on XEN PV (Petr Vaněk)
- x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (Dave Hansen) [Orabug: 37977013] {CVE-2025-37964}
- staging: axis-fifo: Correct handling of tx_fifo_depth for size validation (Gabriel)
- staging: axis-fifo: Remove hardware resets for user errors (Gabriel)
- staging: bcm2835-camera: Initialise dev in v4l2_dev (Dave Stevenson) [Orabug: 37977042] {CVE-2025-37971}
- staging: iio: adc: ad7816: Correct conditional logic for store mode (Gabriel)
- rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.87.0 (Miguel Ojeda)
- rust: clean Rust 1.88.0's `unnecessary_transmutes` lint (Miguel Ojeda)
- Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 (Aditya Garg)
- Input: synaptics - enable SMBus for HP Elitebook 850 G1 (Dmitry Torokhov)
- Input: synaptics - enable InterTouch on Dell Precision M3800 (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30L-G (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30-D (Manuel Fombuena)
- Input: xpad - fix two controller table values (Vicki Pfau)
- Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller (Lode Willems)
- Input: xpad - fix Share button on Xbox One controllers (Vicki Pfau)
- Input: mtk-pmic-keys - fix possible null pointer dereference (Gary Bisson) [Orabug: 37977044] {CVE-2025-37972}
- Input: cyttsp5 - fix power control issue on wakeup (Mikael Gonella-Bolduc)
- Input: cyttsp5 - ensure minimum reset pulse width (Hugo Villeneuve)
- virtio-net: fix total qstat values (Jakub Kicinski)
- net: export a helper for adding up queue stats (Jakub Kicinski)
- fbnic: Do not allow mailbox to toggle to ready outside fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Pull fbnic_fw_xmit_cap_msg use out of interrupt context (Alexander Duyck)
- fbnic: Improve responsiveness of fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Actually flush_tx instead of stalling out (Alexander Duyck)
- fbnic: Gate AXI read/write enabling on FW mailbox (Alexander Duyck)
- fbnic: Fix initialization of mailbox descriptor rings (Alexander Duyck)
- net: dsa: b53: do not set learning and unicast/multicast on up (Jonas Gorski)
- net: dsa: b53: fix learning on VLAN unaware bridges (Jonas Gorski)
- net: dsa: b53: fix toggling vlan_filtering (Jonas Gorski)
- net: dsa: b53: do not program vlans when vlan filtering is off (Jonas Gorski)
- net: dsa: b53: do not allow to configure VLAN 0 (Jonas Gorski)
- net: dsa: b53: always rejoin default untagged VLAN on bridge leave (Jonas Gorski)
- net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave (Jonas Gorski)
- net: dsa: b53: fix flushing old pvid VLAN on pvid change (Jonas Gorski)
- net: dsa: b53: fix clearing PVID of a port (Jonas Gorski)
- net: dsa: b53: keep CPU port always tagged again (Jonas Gorski)
- net: dsa: b53: allow leaky reserved multicast (Jonas Gorski)
- bpf: Scrub packet on bpf_redirect_peer (Paul Chaignon) [Orabug: 37976990] {CVE-2025-37959}
- netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015141] {CVE-2025-37997}
- ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [Orabug: 37976996] {CVE-2025-37961}
- erofs: ensure the extra temporary copy is valid for shortened bvecs (Gao Xiang)
- ice: use DSN instead of PCI BDF for ice_adapter index (Przemek Kitszel)
- ice: Initial support for E825C hardware in ice_adapter (Sergey Temerkhanov)
- wifi: mac80211: fix the type of status_code for negotiated TID to Link Mapping (Michael-Cy Lee)
- can: gw: fix RCU/BH usage in cgw_create_job() (Oliver Hartkopp)
- can: mcp251xfd: fix TDC setting for low data bit rates (Kelsey Maes)
- can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe (Antonios Salios) [Orabug: 38015123] {CVE-2025-37993}
- net: ethernet: mtk_eth_soc: do not reset PSE when setting FE (Frank Wunderlich)
- net: ethernet: mtk_eth_soc: reset all TX queues on DMA free (Daniel Golle)
- gre: Fix again IPv6 link-local address generation. (Guillaume Nault)
- virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (Jakub Kicinski) [Orabug: 37976969] {CVE-2025-37955}
- virtio_net: xsk: bind/unbind xsk for tx (Xuan Zhuo)
- sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 37977176] {CVE-2025-37953}
- s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
- ksmbd: fix memory leak in parse_lease_state() (Zhaolong Wang) [Orabug: 37977180] {CVE-2025-37962}
- openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015148] {CVE-2025-37998}
- ksmbd: Fix UAF in __close_file_table_ids (Sean Heelan) [Orabug: 37976951] {CVE-2025-37952}
- ksmbd: prevent out-of-bounds stream writes by validating *pos (Norbert Szetei) [Orabug: 37976923] {CVE-2025-37947}
- ksmbd: prevent rename with empty string (Namjae Jeon) [Orabug: 37976972] {CVE-2025-37956}
- can: rockchip_canfd: rkcanfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Niklas Schnelle) [Orabug: 37976920] {CVE-2025-37946}
- vfio/pci: Align huge faults to order (Alex Williamson)
- wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation (Veerendranath Jakkam) [Orabug: 37977046] {CVE-2025-37973}
- s390/pci: Fix missing check for zpci_create_device() error return (Niklas Schnelle) [Orabug: 37977050] {CVE-2025-37974}
- can: mcan: m_can_class_unregister(): fix order of unregistration calls (Marc Kleine-Budde)
- firmware: arm_scmi: Fix timeout checks on polling path (Cristian Marussi)
- arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2 (Wojciech Dubowik)
- Revert "btrfs: canonicalize the device path before adding it" (Qu Wenruo)
- fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (Max Kellermann) [Orabug: 38015155] {CVE-2025-37999}
- dm: add missing unlock on in dm_keyslot_evict() (Dan Carpenter)
- mm/vmscan: wake up flushers conditionally to avoid cgroup OOM (Zeng Jingxiang) [Orabug: 37480932]
- dmaengine: idxd: Narrow the restriction on BATCH to ver. 1 only (Vinicius Costa Gomes) [Orabug: 37801355]
- uek-rpm: build the fwctl mlx5 driver on UEK (Qing Huang) [Orabug: 37810636]
- fwctl: Adapt upstream code for UEK8 (Mikhael Goikhman) [Orabug: 37810636]
- mlx5: Create an auxiliary device for fwctl_mlx5 (Saeed Mahameed) [Orabug: 37810636]
- fwctl/mlx5: Support for communicating with mlx5 fw (Saeed Mahameed) [Orabug: 37810636]
- fwctl: Add documentation (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware (Jason Gunthorpe) [Orabug: 37810636]
- taint: Add TAINT_FWCTL (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_INFO to return basic information about the device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Basic ioctl dispatch for the character device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Add basic structure for a class subsystem with a cdev (Jason Gunthorpe) [Orabug: 37810636]
- Revert "fwctl: Add basic structure for a class subsystem with a cdev" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Basic ioctl dispatch for the character device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_INFO to return basic information about the device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Support for communicating with mlx5 fw" (Qing Huang) [Orabug: 37810636]
- Revert "mlx5: Create an auxiliary device for fwctl_mlx5" (Qing Huang) [Orabug: 37810636]
- Revert "taint: Add TAINT_FWCTL" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Adapt code for UEK-NEXT" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Add INTERNAL_DEV_RES uctx capability" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Allow up to 4k devices" (Qing Huang) [Orabug: 37810636]
- Revert "uek-rpm: build the fwctl mlx5 driver on UEK" (Qing Huang) [Orabug: 37810636]
- dmaengine: idxd: Change err messages to dbg (Jack Vogel) [Orabug: 37841831]
- PCI: Add PCI_VDEVICE_SUB helper macro (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbevf: Add support for Intel(R) E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Enable link management in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Clean up the E610 link management related code (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add ixgbe_x540 multiple header inclusion protection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for EEPROM dump in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for NVM handling in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add link management support for E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 device capabilities detection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 FW Admin Command Interface (Piotr Kwapulinski) [Orabug: 37889575]
- uek-rpm: Move the gve kernel module from extra to kernel-uek-core (Samasth Norway Ananda) [Orabug: 37940897]
- uek-rpm/config-aarch64: Enable BT_HCIUART_BCM for RPi Bluetooth (Vijay Kumar) [Orabug: 37961540]
- platform/mellanox: mlxbf-pmc: Support additional PMC blocks (Shravan Kumar Ramani) [Orabug: 37964051]
- mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug: 37964051,38037120] {CVE-2025-37866}
- mlxbf-bootctl: Support sysfs entries for RTC battery status (Xiangrong Li) [Orabug: 37964051]
- platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37964051]
- uek-rpm: CONFIG_PTP_1588_CLOCK_OCP enable for OCI (Vijayendra Suman) [Orabug: 37966384]
- x86/its: Fix build errors when CONFIG_MODULES=n (Eric Biggers) [Orabug: 37970148]
- x86/its: Use dynamic thunks for indirect branches (Peter Zijlstra) [Orabug: 37970148]
- x86/ibt: Keep IBT disabled during alternative patching (Pawan Gupta) [Orabug: 37970148]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 37989268]
- amd_hsmp: Increase the SMU timeout to 500ms (Vijay Kumar) [Orabug: 38000074]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge)  [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang)  [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming)  [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams)  [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson)  [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley)  [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson)  [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson)  [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang)  [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang)  [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang)  [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang)  [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang)  [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang)  [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie)  [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie)  [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen)  [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen)  [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda)  [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda)  [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.1.el10uek]" date="1750939200">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.2.el10uek]" date="1752148800">- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38178286]  {CVE-2025-38089}
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38162790]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38175263]
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)  [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)  [Orabug: 38175246]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.3.el10uek]" date="1752494400">- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38171405]</changelog>
</package>
<package pkgid="d5c4fc2f4931d039aa78de10f57276df8e8baef4" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="101.33.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge) [Orabug: 37976747] {CVE-2025-37903}
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi) [Orabug: 37976752] {CVE-2025-37905}
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [Orabug: 37976858] {CVE-2025-37932}
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski) [Orabug: 37976760] {CVE-2025-37907}
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang) [Orabug: 37976762] {CVE-2025-37908}
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh Edara) [Orabug: 37976864] {CVE-2025-37933}
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan) [Orabug: 37976765] {CVE-2025-37909}
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon) [Orabug: 37976771] {CVE-2025-37910}
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang) [Orabug: 37976728] {CVE-2025-37894}
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein) [Orabug: 37976869] {CVE-2025-37934}
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab) [Orabug: 37976773] {CVE-2025-37911}
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh Ap)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya Kn) [Orabug: 37976731] {CVE-2025-37895}
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe) [Orabug: 37976872] {CVE-2025-37935}
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai) [Orabug: 37970918] {CVE-2025-37891}
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Luoxuanqiang) [Orabug: 37976779] {CVE-2025-37912}
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976783] {CVE-2025-37913}
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976788] {CVE-2025-37914}
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira) [Orabug: 37970915] {CVE-2025-37890}
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976792] {CVE-2025-37915}
- pds_core: remove write-after-free of client_id (Shannon Nelson) [Orabug: 37976797] {CVE-2025-37916}
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud) [Orabug: 37976802] {CVE-2025-37917}
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu) [Orabug: 37976804] {CVE-2025-37918}
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu) [Orabug: 37976806] {CVE-2025-37919}
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (Eryk Kubanski) [Orabug: 37976809] {CVE-2025-37920}
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel) [Orabug: 37976815] {CVE-2025-37921}
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov) [Orabug: 37976734] {CVE-2025-37897}
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom) [Orabug: 37976819] {CVE-2025-37922}
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Sun Peng Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park) [Orabug: 37976821] {CVE-2025-37923}
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan) [Orabug: 37976738] {CVE-2025-37899}
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan) [Orabug: 37976828] {CVE-2025-37924}
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon) [Orabug: 37976832] {CVE-2025-37926}
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen) [Orabug: 37976741] {CVE-2025-37900}
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov) [Orabug: 37976836] {CVE-2025-37927}
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (Longping Wei) [Orabug: 37976844] {CVE-2025-37928}
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Xu Wang) [Orabug: 37977118] {CVE-2025-37990}
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold) [Orabug: 37976744] {CVE-2025-37901}
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson) [Orabug: 37976874] {CVE-2025-37936}
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller) [Orabug: 37977127] {CVE-2025-37991}
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon) [Orabug: 37977182] {CVE-2025-37929}
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner) [Orabug: 37976850] {CVE-2025-37930}
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik) [Orabug: 37976853] {CVE-2025-37931}
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya) [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil) [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert) [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter) [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King) [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche) [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert) [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar) [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang) [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli) [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre) [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta) [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon) [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon) [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth) [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth) [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick) [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli) [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval) [Orabug: 37930100] {CVE-2025-37821}
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang) [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed) [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan) [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.31.1.el10uek]" date="1748952000">- LTS version: v6.12.31 (Jack Vogel)
- drm/gem: Internally test import_attach for imported objects (Thomas Zimmermann)
- x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers (Balbir Singh)
- i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() (Nathan Chancellor)
- pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group() (Dan Carpenter)
- watchdog: aspeed: fix 64-bit division (Arnd Bergmann)
- drm/amdkfd: Correct F8_MODE for gfx950 (Amber Lin)
- serial: sh-sci: Save and restore more registers (Geert Uytterhoeven)
- bpf: abort verification if env-&gt;cur_state-&gt;loop_entry != NULL (Eduard Zingerman)
- drm/amd/display: Exit idle optimizations before accessing PHY (Ovidiu Bunea)
- kbuild: Properly disable -Wunterminated-string-initialization for clang (Nathan Chancellor)
- Fix mis-uses of 'cc-option' for warning disablement (Linus Torvalds)
- gcc-15: disable '-Wunterminated-string-initialization' entirely for now (Linus Torvalds)
- gcc-15: make 'unterminated string initialization' just a warning (Linus Torvalds)
- err.h: move IOMEM_ERR_PTR() to err.h (Raag Jadav)
- spi: spi-fsl-dspi: Reset SR flags before sending a new message (Larisa Grigore)
- spi: spi-fsl-dspi: Halt the module after a new message transfer (Bogdan-Gabriel Roman)
- spi: spi-fsl-dspi: restrict register range for regmap access (Larisa Grigore)
- spi: use container_of_cont() for to_spi_device() (Greg Kroah-Hartman)
- platform/x86: think-lmi: Fix attribute name usage for non-compliant items (Mark Pearson)
- ksmbd: fix stream write failure (Namjae Jeon)
- Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection" (Jernej Skrabec)
- Bluetooth: btmtksdio: Do close if SDIO card removed without close (Chris Lu)
- Bluetooth: btmtksdio: Check function enabled before doing close (Chris Lu)
- nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() (Ryusuke Konishi)
- mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled (Ignacio Moreno Gonzalez)
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Tianyang Zhang)
- memcg: always call cond_resched() after fn() (Breno Leitao)
- highmem: add folio_test_partial_kmap() (Matthew Wilcox)
- Input: xpad - add more controllers (Vicki Pfau)
- Revert "drm/amd: Keep display off while going into S4" (Mario Limonciello)
- smb: client: Reset all search buffer pointers when releasing buffer (Zhaolong Wang)
- arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (Gabor Juhos)
- smb: client: Fix use-after-free in cifs_fill_dirent (Zhaolong Wang) [Orabug: 38094970] {CVE-2025-38051}
- drm/edid: fixed the bug that hdr metadata was not reset (Feijuan Li)
- thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature (Zhang Rui)
- platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin) [Orabug: 38095141] {CVE-2025-38077}
- pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
- pmdomain: renesas: rcar: Remove obsolete nullify checks (Geert Uytterhoeven)
- vmxnet3: update MTU after device quiesce (Ronak Doshi)
- net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
- can: kvaser_pciefd: Fix echo_skb race (Axel Forsman)
- can: kvaser_pciefd: Continue parsing DMA buf after dropped RX (Axel Forsman)
- llc: fix data loss when reading from a socket in llc_ui_recvmsg() (Gavrilov Ilia)
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10 (Ed Burcher)
- ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [Orabug: 38095145] {CVE-2025-38078}
- ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction (Peter Ujfalusi)
- ASoc: SOF: topology: connect DAI to a single DAI link (Kai Vehmanen)
- ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext (Peter Ujfalusi)
- can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp) [Orabug: 38049369] {CVE-2025-38003}
- can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 38049374] {CVE-2025-38004}
- can: slcan: allow reception of short error messages (Carlos Sanchez)
- padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094842] {CVE-2025-38031}
- crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [Orabug: 38095153] {CVE-2025-38079}
- clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe() (André Draszik)
- octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG (Geetha Sowjanya)
- octeontx2-af: Set LMT_ENA bit for APR table entries (Subbaraya Sundeep)
- net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang) [Orabug: 38094978] {CVE-2025-38052}
- octeontx2-pf: Add AF_XDP non-zero copy support (Suman Ghosh)
- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [Orabug: 38049357] {CVE-2025-38000}
- idpf: fix idpf_vport_splitq_napi_poll() (Eric Dumazet)
- io_uring: fix overflow resched cqe reordering (Pavel Begunkov)
- net: lan743x: Restore SGMII CTRL register on resume (Thangaraj Samynathan)
- net: dwmac-sun8i: Use parsed internal PHY address instead of 1 (Paul Kocialkowski)
- pinctrl: qcom: switch to devm_register_sys_off_handler() (Dmitry Baryshkov)
- loop: don't require -&gt;write_iter for writable files in loop_configure (Christoph Hellwig)
- idpf: fix null-ptr-deref in idpf_features_check (Pavan Kumar Linga) [Orabug: 38094982] {CVE-2025-38053}
- ice: Fix LACP bonds without SRIOV environment (Dave Ertman)
- ice: fix vf-&gt;num_mac count with port representors (Jacob Keller)
- bridge: netfilter: Fix forwarding of fragmented packets (Ido Schimmel)
- ptp: ocp: Limit signal/freq counts in summary output functions (Sagi Maimon) [Orabug: 38094984] {CVE-2025-38054}
- Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling (En-Wei Wu)
- Bluetooth: L2CAP: Fix not checking l2cap_chan security level (Luiz Augusto von Dentz)
- perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter) [Orabug: 38094988] {CVE-2025-38055}
- irqchip/riscv-imsic: Start local sync timer on correct CPU (Andrew Bresticker)
- ASoC: SOF: Intel: hda: Fix UAF when reloading module (Tavian Barnes) [Orabug: 38094991] {CVE-2025-38056}
- devres: Introduce devm_kmemdup_array() (Raag Jadav)
- driver core: Split devres APIs to device/devres.h (Andy Shevchenko)
- dmaengine: fsl-edma: Fix return code for unhandled interrupts (Stefan Wahren)
- dmaengine: idxd: Fix -&gt;poll() return value (Dave Jiang)
- xfrm: Sanitize marks before insert (Paul Chaignon)
- clk: sunxi-ng: d1: Add missing divider for MMC mod clocks (Andre Przywara)
- remoteproc: qcom_wcnss: Fix on platforms without fallback regulators (Matti Lehtimäki)
- kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() (David Hildenbrand)
- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (Seongman Lee)
- dmaengine: idxd: Fix allowing write() from different address spaces (Vinicius Costa Gomes)
- xfrm: Fix UDP GRO handling for some corner cases (Tobias Brunner)
- espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca)
- espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094993] {CVE-2025-38057}
- soundwire: bus: Fix race on the creation of the IRQ domain (Charles Keepax)
- __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [Orabug: 38095000] {CVE-2025-38058}
- drm/amd/display: Call FP Protect Before Mode Programming/Mode Support (Austin Zheng)
- xenbus: Allow PVH dom0 a non-local xenstore (Jason Andryuk)
- x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust &gt;= 1.88 (Paweł Anikiel) [Orabug: 38094847] {CVE-2025-38033}
- wifi: iwlwifi: add support for Killer on MTL (Johannes Berg)
- block: only update request sector if needed (Johannes Thumshirn)
- tools: ynl-gen: validate 0 len strings from kernel (David Wei)
- btrfs: avoid NULL pointer dereference if no valid csum tree (Qu Wenruo) [Orabug: 38095010] {CVE-2025-38059}
- btrfs: handle empty eb-&gt;folios in num_extent_folios() (Boris Burkov)
- btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [Orabug: 38094856] {CVE-2025-38034}
- btrfs: compression: adjust cb-&gt;compressed_folios allocation type (Kees Cook)
- ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers (Stefan Binding)
- cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function (Pali Rohár)
- cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info() (Pali Rohár)
- io_uring/fdinfo: annotate racy sq/cq head/tail reads (Jens Axboe)
- nvmet-tcp: don't restore null sk_state_change (Alistair Francis) [Orabug: 38094863] {CVE-2025-38035}
- ALSA: usb-audio: Fix duplicated name in MIDI substream names (Takashi Iwai)
- nvme-pci: add quirks for WDC Blue SN550 15b7:5009 (Guan Wentao)
- nvme-pci: add quirks for device 126f:1001 (Guan Wentao)
- ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 (Takashi Iwai)
- ASoC: cs42l43: Disable headphone clamps during type detection (Charles Keepax)
- platform/x86: ideapad-laptop: add support for some new buttons (Gašper Nemgar)
- platform/x86: asus-wmi: Disable OOBE state after resume from hibernation (Pavel Nikulin)
- platform/x86/intel: hid: Add Pantherlake support (Saranya Gopal)
- smb: server: smb2pdu: check return value of xa_store() (Salah Triki)
- pinctrl: meson: define the pull up/down resistor value as 60 kOhm (Martin Blumenstingl)
- book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n (Ritesh Harjani)
- ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of() (Chenyuan Yang)
- drm: Add valid clones check (Jessica Zhang)
- drm/panel-edp: Add Starry 116KHD024006 (Douglas Anderson)
- drm/buddy: fix issue that force_merge cannot free all roots (Lin Cao)
- drm/atomic: clarify the rules around drm_atomic_state-&gt;allow_modeset (Simona Vetter)
- drm/xe: Reject BO eviction if BO is bound to current VM (Oak Zeng)
- drm/xe/sa: Always call drm_suballoc_manager_fini() (Michal Wajdeczko)
- wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event (Ching-Te Ku)
- drm/xe: Do not attempt to bootstrap VF in execlists mode (Maarten Lankhorst)
- drm/xe: Move suballocator init to after display init (Maarten Lankhorst)
- wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (P Praneesh)
- drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE (Zhi Wang)
- drm: bridge: adv7511: fill stream capabilities (Olivier Moysan)
- wifi: ath12k: Fix end offset bit definition in monitor ring descriptor (P Praneesh)
- wifi: ath12k: Fetch regdb.bin file from board-2.bin (Aaradhana Sahu)
- wifi: ath9k: return by of_get_mac_address (Rosen Penev)
- drm/xe/pf: Reset GuC VF config when unprovisioning critical resource (Michal Wajdeczko)
- accel/qaic: Mask out SR-IOV PCI resources (Youssef Samir)
- wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override (Nicolas Escande)
- regulator: ad5398: Add device tree support (Isaac Scott)
- spi: zynqmp-gqspi: Always acknowledge interrupts (Sean Anderson)
- wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet (Ping-Ke Shih)
- wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate (Bitterblue Smith)
- wifi: rtl8xxxu: retry firmware download on error (Soeren Moch)
- clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation (Lad Prabhakar)
- perf/amd/ibs: Fix -&gt;config to sample period calculation for OP PMU (Ravi Bangoria)
- perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (Ravi Bangoria)
- firmware: arm_scmi: Relax duplicate name constraint across protocol ids (Sudeep Holla)
- bpftool: Fix readlink usage in get_fd_type (Viktor Malik)
- bpf: Use kallsyms to find the function name of a struct_ops's stub function (Martin Kafai Lau)
- drm/ast: Find VBIOS mode from regular display size (Thomas Zimmermann)
- dm vdo: use a short static string for thread name prefix (Matthew Sakai)
- dm vdo indexer: prevent unterminated string warning (Chung Chung)
- irqchip/riscv-aplic: Add support for hart indexes (Vladimir Kondratiev)
- ASoC: rt722-sdca: Add some missing readable registers (Charles Keepax)
- ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode (Cezary Rojewski)
- arm64: zynqmp: add clock-output-names property in clock nodes (Naman Trivedi Manojbhai)
- HID: usbkbd: Fix the bit shift number for LED_KANA (Junan)
- wifi: ath12k: Avoid napi_sync() before napi_enable() (Avula Sri Charan)
- scsi: st: Restore some drive settings after reset (Kai Mäkisara)
- net/mana: fix warning in the writer of client oob (Konstantin Taranov)
- drm/xe/relay: Don't use GFP_KERNEL for new transactions (Michal Wajdeczko)
- ice: count combined queues using Rx/Tx count (Michal Swiatkowski)
- perf: Avoid the read if the count is already updated (Peter Zijlstra)
- rcu: fix header guard for rcu_all_qs() (Ankur Arora)
- rcu: handle unstable rdp in rcu_read_unlock_strict() (Ankur Arora)
- rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y (Ankur Arora)
- ice: treat dyn_allowed only as suggestion (Michal Swiatkowski)
- ice: init flow director before RDMA (Michal Swiatkowski)
- bridge: mdb: Allow replace of a host-joined group (Petr Machata)
- net: flush_backlog() small changes (Eric Dumazet)
- r8169: don't scan PHY addresses &gt; 0 (Heiner Kallweit)
- ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only (Geert Uytterhoeven)
- vxlan: Annotate FDB data races (Ido Schimmel) [Orabug: 38094879] {CVE-2025-38037}
- cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (Dhananjay Ugwekar) [Orabug: 38094888] {CVE-2025-38038}
- tools: ynl-gen: don't output external constants (Jakub Kicinski)
- eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs (Alexander Duyck)
- drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0 (Cristian Ciocaltea)
- media: qcom: camss: Add default case in vfe_src_pad_code (Depeng Shao)
- media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available (Depeng Shao)
- f2fs: introduce f2fs_base_attr for global sysfs entries (Jaegeuk Kim)
- hwmon: (xgene-hwmon) use appropriate type for the latency value (Andrey Vatoropin)
- tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options (Len Brown)
- net: page_pool: avoid false positive warning if NAPI was never added (Jakub Kicinski)
- clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs (Jordan Crouse)
- wifi: rtw89: call power_on ahead before selecting firmware (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before accessing (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before getting its size (Ping-Ke Shih)
- wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang (Ching-Te Ku)
- wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix download_firmware_validate() for RTL8814AU (Bitterblue Smith)
- ext4: remove writable userspace mappings before truncating page cache (Zhang Yi)
- ext4: don't write back data before punch hole in nojournal mode (Zhang Yi)
- leds: trigger: netdev: Configure LED blink interval for HW offload (Marek Vasut)
- pstore: Change kmsg_bytes storage size to u32 (Kees Cook)
- iio: adc: ad7944: don't use storagebits for sizing (David Lechner)
- r8152: add vendor/device ID pair for Dell Alienware AW1022z (Aleksander Jan Bajkowski)
- ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). (Kuniyuki Iwashima)
- arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src (Athira Rajeev)
- powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (Gaurav Batra)
- powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Gaurav Batra)
- net: fec: Refactor MAC reset to function (Csókás Bence)
- wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx (Emmanuel Grumbach)
- wifi: mac80211: remove misplaced drv_mgd_complete_tx() call (Johannes Berg)
- wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() (Johannes Berg)
- wifi: iwlwifi: don't warn during reprobe (Miri Korenblit)
- wifi: iwlwifi: use correct IMR dump variable (Johannes Berg)
- mptcp: pm: userspace: flags: clearer msg if no remote addr (Matthieu Baerts)
- wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV (P Praneesh)
- xfrm: prevent high SEQ input in non-ESN mode (Leon Romanovsky)
- drm/v3d: Add clock handling (Stefan Wahren)
- net/mlx5e: reduce the max log mpwrq sz for ECPF and reps (William Tu)
- net/mlx5e: reduce rep rxq depth to 256 for ECPF (William Tu)
- net/mlx5e: set the tx_queue_len for pfifo_fast (William Tu)
- net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB (Alexei Lazar)
- net/mlx5: XDP, Enable TX side XDP multi-buffer support (Alexei Lazar)
- scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr() (Chaohai Chen)
- drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer() (Alex Deucher)
- drm/amdgpu: enlarge the VBIOS binary size limit (Morris Zhang)
- drm/amdgpu: Use active umc info from discovery (Lijo Lazar)
- drm/amd/display: Populate register address for dentist for dcn401 (Dillon Varone)
- drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It (Austin Zheng)
- drm/amd/display: Increase block_sequence array size (Joshua Aberback) [Orabug: 38095164] {CVE-2025-38080}
- drm/amd/display: Initial psr_version with correct setting (Tom Chung)
- drm/amd/display: Update CR AUX RD interval interpretation (George Shen)
- Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY" (Brandon Syu)
- drm/amd/display: Support multiple options during psr entry. (Martin Tsai)
- drm/amd/pm: Skip P2S load for SMU v13.0.12 (Asad Kamal)
- drm/amdgpu: reset psp-&gt;cmd to NULL after releasing the buffer (Jiang Liu)
- drm/amd/display: Don't try AUX transactions on disconnected link (Ilya Bakoulin)
- drm/amd/display: pass calculated dram_speed_mts to dml2 (Charlene Liu)
- drm/amdgpu: Set snoop bit for SDMA for MI series (Harish Kasiviswanathan)
- drm/amdkfd: fix missing L2 cache info in topology (Eric Huang)
- drm/amdgpu/mes11: fix set_hw_resources_1 calculation (Alex Deucher)
- net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size (Huacai Chen)
- soundwire: cadence_master: set frame shape and divider based on actual clk freq (Bard Liao)
- soundwire: amd: change the soundwire wake enable/disable sequence (Vijendar Mukunda)
- phy: exynos5-usbdrd: fix EDS distribution tuning (gs101) (André Draszik)
- phy: core: don't require set_mode() callback for phy_get_mode() to work (Dmitry Baryshkov)
- phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF (Damon Ding)
- pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down (Claudiu Beznea)
- serial: sh-sci: Update the suspend/resume support (Claudiu Beznea)
- sched: Reduce the default slice to avoid tasks getting an extra tick (Zihan Zhou)
- x86/traps: Cleanup and robustify decode_bug() (Peter Zijlstra)
- x86/ibt: Handle FineIBT in handle_cfi_failure() (Peter Zijlstra)
- drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set (Shuicheng Lin)
- drm/xe/debugfs: fixed the return value of wedged_mode_set (Xin Wang)
- clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate (Krzysztof Kozlowski)
- clk: qcom: ipq5018: allow it to be bulid on arm32 (Karl Chan)
- drm/xe: Fix xe_tile_init_noalloc() error propagation (Lucas De Marchi)
- drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init() (Lucas De Marchi)
- net/mlx4_core: Avoid impossible mlx4_db_alloc() order value (Kees Cook)
- media: v4l: Memset argument to 0 before calling get_mbus_config pad op (Sakari Ailus)
- media: i2c: imx219: Correct the minimum vblanking value (David Plowman)
- kunit: tool: Use qboot on QEMU x86_64 (Brendan Jackman)
- smack: Revert "smackfs: Added check catlen" (Konstantin Andreev)
- smack: recognize ipv4 CIPSO w/o categories (Konstantin Andreev)
- pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map (Valentin Caron)
- ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() (Kuninori Morimoto)
- ASoC: tas2764: Power up/down amp on mute ops (Hector Martin)
- ASoC: tas2764: Mark SW_RESET as volatile (Hector Martin)
- ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG (Hector Martin)
- ASoC: ops: Enforce platform maximum on initial value (Martin Povišer)
- firmware: xilinx: Dont send linux address to get fpga config get status (Siva Durga Prasad Paladugu)
- firmware: arm_ffa: Handle the presence of host partition in the partition info (Sudeep Holla)
- firmware: arm_ffa: Reject higher major version as incompatible (Sudeep Holla)
- net/mlx5: Apply rate-limiting to high temperature warning (Shahar Shitrit)
- net/mlx5: Modify LSB bitmask in temperature event to include only the first bit (Shahar Shitrit)
- media: test-drivers: vivid: don't call schedule in loop (Hans Verkuil)
- irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base (Andrew Jones)
- hrtimers: Replace hrtimer_clock_to_base_table with switch-case (Andy Shevchenko)
- vxlan: Join / leave MC group after remote changes (Petr Machata)
- ACPI: HED: Always initialize before evged (Xiaofei Tan)
- PCI: Fix old_size lower bound in calculate_iosize() too (Ilpo Järvinen)
- eth: mlx4: don't try to complete XDP frames in netpoll (Jakub Kicinski)
- bpf: copy_verifier_state() should copy 'loop_entry' field (Eduard Zingerman) [Orabug: 38095018] {CVE-2025-38060}
- bpf: don't do clean_live_states when state-&gt;loop_entry-&gt;branches &gt; 0 (Eduard Zingerman)
- can: c_can: Use of_property_present() to test existence of DT property (Krzysztof Kozlowski)
- pmdomain: imx: gpcv2: use proper helper for property detection (Ahmad Fatoum)
- RDMA/core: Fix best page size finding when it can cross SG entries (Michael Margolin)
- serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (Alexis Lothoré) [Orabug: 38094901] {CVE-2025-38040}
- drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink (Harry Wentland)
- Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP" (Leo Zeng)
- drm/amd/display: Read LTTPR ALPM caps during link cap retrieval (George Shen)
- drm/amd/display: Fix BT2020 YCbCr limited/full range input (Ilya Bakoulin)
- drm/amd/display: Guard against setting dispclk low when active (Nicholas Kazlauskas)
- drm/amd/display: Add support for disconnected eDP streams (Harry Vanzylldejong)
- drm/amd/pm: Fetch current power limit from PMFW (Lijo Lazar)
- irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector (Anup Patel)
- eeprom: ee1004: Check chip before probing (Eddie James)
- mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs (Chris Morgan)
- i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA) (Frank Li)
- EDAC/ie31200: work around false positive build warning (Arnd Bergmann)
- power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree (Chris Morgan)
- net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [Orabug: 38095024] {CVE-2025-38061}
- wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU (Kuan-Chung Chen)
- wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware (Ping-Ke Shih)
- wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32() (Ping-Ke Shih)
- wifi: rtw89: fw: propagate error code from rtw89_h2c_tx() (Ping-Ke Shih)
- wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU (Bitterblue Smith)
- PCI: epf-mhi: Update device ID for SA8775P (Mrinmay Sarkar)
- clocksource: mips-gic-timer: Enable counter when CPUs start (Paul Burton)
- MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core (Paul Burton)
- genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (Jason Gunthorpe) [Orabug: 38095031] {CVE-2025-38062}
- x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op() (Uros Bizjak)
- drm/amdgpu: remove all KFD fences from the BO on release (Christian König)
- MIPS: Use arch specific syscall name match function (Bibo Mao)
- drm/xe/oa: Ensure that polled read returns latest data (Umesh Nerlige Ramappa)
- net: ipv6: Init tunnel link-netns before registering dev (Xiao Liang)
- crypto: skcipher - Zap type in crypto_alloc_sync_skcipher (Herbert Xu)
- crypto: ahash - Set default reqsize from ahash_alg (Herbert Xu)
- x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh)
- net/mlx5: Change POOL_NEXT_SIZE define value and make it global (Patrisious Haddad)
- scsi: scsi_debug: First fixes for tapes (Kai Mäkisara)
- dm: fix unconditional IO throttle caused by REQ_PREFLUSH (Jinliang Zheng) [Orabug: 38095038] {CVE-2025-38063}
- libbpf: Fix out-of-bound read (Nandakumar Edamana)
- loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize (Christoph Hellwig)
- net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode (Jianbo Liu)
- media: tc358746: improve calculation of the D-PHY timing registers (Matthias Fend)
- media: adv7180: Disable test-pattern control on adv7180 (Niklas Söderlund)
- cpuidle: menu: Avoid discarding useful information (Rafael J. Wysocki)
- vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines (Konstantin Shkolnyy)
- x86/nmi: Add an emergency handler in nmi_desc &amp; use it in nmi_shootdown_cpus() (Waiman Long)
- ASoC: mediatek: mt8188: Add reference for dmic clocks (Nícolas F R A Prado)
- ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile (Nícolas F R A Prado)
- drm/amd/display: Fix mismatch type comparison (Navid Assadian)
- drm/amd/display: fix dcn4x init failed (Charlene Liu)
- drm/amd/display: handle max_downscale_src_width fail check (Yihan Zhu)
- x86/build: Fix broken copy command in genimage.sh when making isoimage (Nir Lichtman)
- Octeontx2-af: RPM: Register driver with PCI subsys IDs (Hariprasad Kelam)
- bpf: Search and add kfuncs in struct_ops prologue and epilogue (Amery Hung)
- soc: ti: k3-socinfo: Do not use syscon helper to build regmap (Andrew Davis)
- wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band (Ramasamy Kaliappan)
- bonding: report duplicate MAC address in all situations (Hangbin Liu)
- net: xgene-v2: remove incorrect ACPI_PTR annotation (Arnd Bergmann)
- net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only (Eric Woudstra)
- leds: pwm-multicolor: Add check for fwnode_property_read_u32 (Yuanjun Gong)
- drm/xe: xe_gen_wa_oob: replace program_invocation_short_name (Daniel Gomez)
- drm/amdkfd: KFD release_work possible circular locking (Philip Yang)
- pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf (Inochi Amaoto)
- selftests/net: have `gro.sh -t` return a correct exit code (Kevin Krakauer)
- net/mlx5: Avoid report two health errors on same syndrome (Moshe Shemesh)
- drm/xe/pf: Create a link between PF and VF devices (K V P Satyanarayana)
- drm/xe/vf: Retry sending MMIO request to GUC on timeout error (K V P Satyanarayana)
- firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar) [Orabug: 38094925] {CVE-2025-38043}
- PCI: brcmstb: Add a softdep to MIP MSI-X driver (Stanimir Varbanov)
- PCI: brcmstb: Expand inbound window size up to 64GB (Stanimir Varbanov)
- wifi: ath12k: Report proper tx completion status to mac80211 (Vinith Kumar R)
- soc: apple: rtkit: Implement OSLog buffers properly (Hector Martin)
- soc: apple: rtkit: Use high prio work queue (Janne Grunau)
- perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters (Rob Herring)
- fpga: altera-cvp: Increase credit timeout (Kuhanh Murugasen Krishnan)
- drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence (AngeloGioacchino Del Regno)
- ARM: at91: pm: fix at91_suspend_finish for ZQ calibration (Li Bin)
- hwmon: (gpio-fan) Add missing mutex locks (Alexander Stein)
- x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Breno Leitao)
- clk: imx8mp: inform CCF of maximum frequency of clocks (Ahmad Fatoum)
- media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value (Ricardo Ribalda)
- media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map (Ricardo Ribalda)
- ublk: complete command synchronously on error (Caleb Sander)
- block: mark bounce buffering as incompatible with integrity (Christoph Hellwig)
- drm/rockchip: vop2: Add uv swap for cluster window (Andy Yan)
- ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). (Kuniyuki Iwashima)
- scsi: logging: Fix scsi_logging_level bounds (Nicolas Bouchinet)
- ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7 (Maciej S. Szmigiero)
- perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (Saket Kumar Bhaskar)
- net: pktgen: fix mpls maximum labels list parsing (Peter Seiderer)
- media: imx335: Set vblank immediately (Paul Elder)
- iommufd: Disallow allocating nested parent domain with fault ID (Yi Liu)
- ublk: enforce ublks_max only for unprivileged devices (Uday Shankar)
- dpll: Add an assertion to check freq_supported_num (Jiasheng Jiang)
- net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104 (Andrei Botila)
- net: ethernet: ti: cpsw_new: populate netdev of_node (Alexander Sverdlin)
- rcu: Fix get_state_synchronize_rcu_full() GP-start detection (Paul E. McKenney)
- pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" (Artur Weber)
- media: cx231xx: set device_caps for 417 (Hans Verkuil) [Orabug: 38094934] {CVE-2025-38044}
- perf/core: Clean up perf_try_init_event() (Peter Zijlstra)
- drm/amd/display: Request HW cursor on DCN3.2 with SubVP (Aric Cyr)
- drm/amd/display: Fix p-state type when p-state is unsupported (Dillon Varone)
- drm/amd/display: Fix DMUB reset sequence for DCN401 (Dillon Varone)
- drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination (George Shen)
- drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35 (Nicholas Kazlauskas)
- drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c (Victor Lu)
- remoteproc: qcom_wcnss: Handle platforms with only single power domain (Matti Lehtimäki)
- blk-throttle: don't take carryover for prioritized processing of metadata (Ming Lei)
- net: phylink: use pl-&gt;link_interface in phylink_expects_phy() (Choong Yong Liang)
- drm/gem: Test for imported GEM buffers with helper (Thomas Zimmermann)
- orangefs: Do not truncate file size (Matthew Wilcox) [Orabug: 38095056] {CVE-2025-38065}
- soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables (AngeloGioacchino Del Regno)
- dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [Orabug: 38095063] {CVE-2025-38066}
- usb: xhci: set page size to the xHCI-supported size (Niklas Neronin)
- media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() (Markus Elfring)
- ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 (Svyatoslav Ryhel)
- soc: samsung: include linux/array_size.h where needed (Arnd Bergmann)
- drm/xe: Retry BO allocation (Matthew Brost)
- drm/xe: Nuke VM's mapping upon close (Matthew Brost)
- ieee802154: ca8210: Use proper setters and getters for bitwise types (Andy Shevchenko)
- rtc: ds1307: stop disabling alarms on probe (Alexandre Belloni)
- tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() (Eric Dumazet)
- ALSA: seq: Improve data consistency at polling (Takashi Iwai)
- powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 (Andreas Schwab)
- arm64: tegra: Resize aperture for the IGX PCIe C5 slot (Jonathan Hunter)
- arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator (Diogo Ivo)
- drm/amdgpu: Fix missing drain retry fault the last entry (Emily Deng)
- drm/amdkfd: Set per-process flags only once cik/vi (Harish Kasiviswanathan)
- drm/amdkfd: Set per-process flags only once for gfx9/10/11/12 (Harish Kasiviswanathan)
- crypto: mxs-dcp - Only set OTP_KEY bit for OTP key (Sven Schwermer)
- crypto: lzo - Fix compression buffer overrun (Herbert Xu) [Orabug: 38095079] {CVE-2025-38068}
- misc: pci_endpoint_test: Give disabled BARs a distinct error code (Niklas Cassel)
- PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops (Christian Bruel) [Orabug: 38095087] {CVE-2025-38069}
- watchdog: aspeed: Update bootstatus handling (Chin-Ting Kuo)
- cpufreq: tegra186: Share policy per cluster (Aaron Kling)
- iommu/amd/pgtbl_v2: Improve error handling (Vasant Hegde)
- coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t (Levi Yun)
- badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable &lt; 0 (Coly Li)
- ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup() (Alexey Klimov)
- auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" (Andy Shevchenko)
- gfs2: Check for empty queue in run_queue (Andreas Gruenbacher)
- drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch (Leon Huang)
- drm/amd/display: not abort link train when bw is low (Peichen Huang)
- drm/amd/display: calculate the remain segments for all pipes (Zhikai Zhai)
- drm/amd/display: remove minimum Dispclk and apply oem panel timing. (Charlene Liu)
- ipv6: save dontfrag in cork (Willem de Bruijn)
- wifi: cfg80211: allow IR in 20 MHz configurations (Anjaneyulu)
- wifi: mac80211_hwsim: Fix MLD address translation (Ilan Peer)
- wifi: mac80211: fix warning on disconnect during failed ML reconf (Johannes Berg)
- wifi: iwlwifi: fix the ECKV UEFI variable name (Emmanuel Grumbach)
- wifi: iwlwifi: mark Br device not integrated (Johannes Berg)
- wifi: iwlwifi: fix debug actions order (Johannes Berg) [Orabug: 38094942] {CVE-2025-38045}
- wifi: iwlwifi: w/a FW SMPS mode selection (Daniel Gabay)
- wifi: iwlwifi: don't warn when if there is a FW error (Miri Korenblit)
- printk: Check CON_SUSPEND when unblanking a console (Marcos Paulo de Souza)
- iommu: Keep dev-&gt;iommu state consistent (Robin Murphy)
- hwmon: (dell-smm) Increment the number of fans (Kurt Borja)
- wifi: iwlwifi: mvm: fix setting the TK when associated (Avraham Stern)
- usb: xhci: Don't change the status of stalled TDs on failed Stop EP (Michał Pecio)
- mmc: sdhci: Disable SD card clock before changing parameters (Erick Shepherd)
- mmc: dw_mmc: add exynos7870 DW MMC support (Kaustabh Chakraborty)
- arm64/mm: Check PUD_TYPE_TABLE in pud_bad() (Ryan Roberts)
- arm64/mm: Check pmd_table() in pmd_trans_huge() (Ryan Roberts)
- phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set (Andy Yan)
- PNP: Expand length of fixup id string (Kees Cook)
- netfilter: conntrack: Bound nf_conntrack sysctl writes (Nicolas Bouchinet)
- wifi: rtw89: set force HE TB mode when connecting to 11ax AP (Dian-Syuan Yang)
- timer_list: Don't use %pK through printk() (Thomas Weißschuh)
- net: hsr: Fix PRP duplicate detection (Jaakko Karrenpalo)
- net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe (Jonas Karlman)
- posix-timers: Ensure that timer initialization is fully visible (Thomas Gleixner)
- posix-timers: Add cond_resched() to posix_timer_add() search loop (Eric Dumazet)
- RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() (Maher Sanalla)
- ext4: do not convert the unwritten extents if data writeback fails (Baokun Li)
- ext4: reject the 'data_err=abort' option in nojournal mode (Baokun Li)
- clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490 (Taniya Das)
- ASoC: sun4i-codec: support hp-det-gpios property (Ryan Walklin)
- drm/amdgpu: Update SRIOV video codec caps (David Rosca)
- drm/amdgpu/gfx11: don't read registers in mqd init (Alex Deucher)
- drm/amdgpu/gfx12: don't read registers in mqd init (Alex Deucher)
- mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check (Shree Ramamoorthy)
- pinctrl-tegra: Restore SFSEL bit when freeing pins (Prathamesh Shete)
- xen: Add support for XenServer 6.1 platform device (Frediano Ziglio)
- net/smc: use the correct ndev to find pnetid by pnetid table (Guangguan Wang)
- dm: restrict dm device size to 2^63-512 bytes (Mikulas Patocka)
- crypto: octeontx2 - suppress auth failure screaming due to negative tests (Shashank Gupta)
- kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf (Masahiro Yamada)
- kbuild: fix argument parsing in scripts/config (Seyediman Seyedarab)
- bpf: Allow pre-ordering for bpf cgroup progs (Yonghong Song)
- ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect (Nícolas F R A Prado)
- ASoC: pcm6240: Drop bogus code handling IRQ as GPIO (Linus Walleij)
- spi: spi-mux: Fix coverity issue, unchecked return value (Sergio Perez Gonzalez)
- erofs: initialize decompression early (Gao Xiang)
- thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer (Mika Westerberg)
- objtool: Fix error handling inconsistencies in check() (Josh Poimboeuf)
- rtc: rv3032: fix EERD location (Alexandre Belloni)
- tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() (Ilpo Järvinen)
- jbd2: do not try to recover wiped journal (Jan Kara)
- PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off() (Frank Li)
- bpf: Return prog btf_id without capable check (Mykyta Yatsenko)
- vfio/pci: Handle INTx IRQ_NOTCONNECTED (Alex Williamson)
- scsi: st: ERASE does not change tape location (Kai Mäkisara)
- scsi: st: Tighten the page format heuristics with MODE SELECT (Kai Mäkisara)
- hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure (Al Viro)
- ext4: reorder capability check last (Christian Göttsche)
- riscv: Call secondary mmu notifier when flushing the tlb (Alexandre Ghiti)
- bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set (Shantiprasad Shettar)
- wifi: mwifiex: Fix HT40 bandwidth issue. (Jeff Chen)
- um: Update min_low_pfn to match changes in uml_reserved (Tiwei Bie)
- um: Store full CSGSFS and SS register from mcontext (Benjamin Berg)
- clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug (Nick Hu)
- dlm: make tcp still work in multi-link env (Heming Zhao)
- s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste() (Heiko Carstens)
- i3c: master: svc: Fix missing STOP for master request (Stanley Chu)
- drm/amdgpu: adjust drm_firmware_drivers_only() handling (Alex Deucher)
- drm/amd/display: Guard against setting dispclk low for dcn31x (Jing Zhou)
- drm/amdgpu: release xcp_mgr on exit (Flora Cui)
- blk-cgroup: improve policy registration error handling (Chen Linxuan)
- btrfs: send: return -ENAMETOOLONG when attempting a path that is too long (Filipe Manana)
- btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work() (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to async workers (Filipe Manana)
- btrfs: run btrfs_error_commit_super() early (Qu Wenruo)
- btrfs: avoid linker error in btrfs_find_create_tree_block() (Mark Harmstone)
- btrfs: make btrfs_discard_workfn() block_group ref explicit (Boris Burkov)
- i2c: pxa: fix call balance of i2c-&gt;clk handling routines (Vitalii Mordan)
- i2c: qup: Vote for interconnect bandwidth to DRAM (Stephan Gerhold)
- x86/mm: Check return value from memblock_phys_alloc_range() (Philip Redkin) [Orabug: 38095101] {CVE-2025-38071}
- x86/microcode: Update the Intel processor flag scan check (Sohil Mehta)
- x86/smpboot: Fix INIT delay assignment for extended Intel Families (Sohil Mehta)
- x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP (Ingo Molnar)
- x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers (Thomas Huth)
- wifi: mt76: mt7925: fix fails to enter low power mode in suspend state (Quan Zhou)
- wifi: mt76: mt7925: load the appropriate CLC data based on hardware type (Ming Yen Hsieh)
- wifi: mt76: mt7996: revise TXS size (Benjamin Lin)
- wifi: mt76: mt7996: fix SER reset trigger on WED reset (Rex Lu)
- wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 (Felix Fietkau)
- cgroup/rstat: avoid disabling irqs for O(num_cpu) (Eric Dumazet)
- drm/amdgpu: Skip pcie_replay_count sysfs creation for VF (Victor Skvortsov)
- mmc: host: Wait for Vdd to settle on card power off (Erick Shepherd)
- staging: vchiq_arm: Create keep-alive thread during probe (Stefan Wahren)
- pidfs: improve multi-threaded exec and premature thread-group leader exit polling (Christian Brauner)
- libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [Orabug: 38095109] {CVE-2025-38072}
- ext4: on a remount, only log the ro or r/w state when it has changed (Nicolas Bretz)
- xen/pci: Do not register devices with segments &gt;= 0x10000 (Roger Pau Monné)
- PCI: vmd: Disable MSI remapping bypass under Xen (Roger Pau Monné)
- drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12 (Jonathan Kim)
- drm/amdgpu/discovery: check ip_discovery fw file available (Flora Cui)
- pNFS/flexfiles: Report ENETDOWN as a connection error (Trond Myklebust)
- tools/build: Don't pass test log files to linker (Ian Rogers)
- r8169: disable RTL8126 ZRX-DC timeout (Chunhao Lin)
- PCI: dwc: ep: Ensure proper iteration over outbound map windows (Frank Li)
- objtool: Properly disable uaccess validation (Josh Poimboeuf)
- lockdep: Fix wait context check on softirq for PREEMPT_RT (Ryo Takakura)
- dql: Fix dql-&gt;limit value when reset. (Jing Su)
- Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken (Pedro Nishiyama)
- Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal (Sean Wang)
- thermal/drivers/qoriq: Power down TMU on system suspend (Alice Guo)
- thermal/drivers/mediatek/lvts: Start sensor interrupts disabled (Nícolas F R A Prado)
- net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus (Hans-Frieder Vogt)
- net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards (Hans-Frieder Vogt)
- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (Daniel Hsu)
- ASoC: codecs: wsa883x: Correct VI sense channel mask (Krzysztof Kozlowski)
- ASoC: codecs: wsa884x: Correct VI sense channel mask (Krzysztof Kozlowski)
- spi-rockchip: Fix register out of bounds access (Luis de Arquer) [Orabug: 38095173] {CVE-2025-38081}
- SUNRPC: rpcbind should never reset the port to the value '0' (Trond Myklebust)
- SUNRPC: rpc_clnt_set_transport() must not change the autobind setting (Trond Myklebust)
- NFSv4: Treat ENETUNREACH errors as fatal for state recovery (Trond Myklebust)
- cifs: Fix establishing NetBIOS session for SMB2+ connection (Pali Rohár)
- cifs: add validation check for the fields in smb_aces (Namjae Jeon)
- cifs: Set default Netbios RFC1001 server name to hostname in UNC (Pali Rohár)
- fbdev: core: tileblit: Implement missing margin clearing for tileblit (Zsolt Kajtar)
- fbcon: Use correct erase colour for clearing in fbcon (Zsolt Kajtar)
- fbdev: fsl-diu-fb: add missing device_remove_file() (Shixiong Ou)
- riscv: Allow NOMMU kernels to access all of RAM (Samuel Holland)
- mailbox: use error ret code of of_parse_phandle_with_args() (Tudor Ambarus)
- mailbox: pcc: Use acpi_os_ioremap() instead of ioremap() (Sudeep Holla)
- tpm: Convert warn to dbg in tpm2_start_auth_session() (Jonathan Mcdowell)
- ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list (Diogo Ivo)
- tracing: Mark binary printing functions with __printf() attribute (Andy Shevchenko)
- iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability (Yi Liu)
- arm64: Add support for HIP09 Spectre-BHB mitigation (Jinqian Yang)
- SUNRPC: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFS: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Trond Myklebust)
- io_uring/msg: initialise msg request opcode (Pavel Begunkov)
- exfat: call bh_read in get_block only when necessary (Sungjong Seo)
- fuse: Return EPERM rather than ENOSYS from link() (Matt Johnston)
- smb: client: Store original IO parameters and prevent zero IO sizes (Zhaolong Wang)
- cifs: Fix negotiate retry functionality (Pali Rohár)
- cifs: Fix querying and creating MF symlinks over SMB1 (Pali Rohár)
- cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES (Pali Rohár)
- s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log (Tony Krowiak)
- x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li) [Orabug: 38094951] {CVE-2025-38047}
- kconfig: merge_config: use an empty file as initfile (Daniel Gomez)
- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (Haoran Jiang)
- bpf: fix possible endless loop in BPF map iteration (Brandon Kammerdiener)
- io_uring: don't duplicate flushing in io_req_post_cqe (Pavel Begunkov)
- block: fix race between set_blocksize and read paths (Darrick J. Wong) [Orabug: 38095117] {CVE-2025-38073}
- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (Ihor Solodrai)
- drm/amdgpu: Allow P2P access through XGMI (Felix Kuehling)
- drm/amd/display: Enable urgent latency adjustment on DCN35 (Nicholas Susanto)
- fs/ext4: use sleeping version of sb_find_get_block() (Davidlohr Bueso)
- fs/jbd2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/ocfs2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: introduce sleeping flavors for pagecache lookups (Davidlohr Bueso)
- fs/buffer: split locking for pagecache lookups (Davidlohr Bueso)
- ima: process_measurement() needlessly takes inode_lock() on MAY_READ (Frederick Lawler)
- dma-mapping: Fix warning reported for missing prototype (Balbir Singh)
- net: enetc: refactor bulk flipping of RX buffers to separate function (Vladimir Oltean)
- vhost_task: fix vhost_task_create() documentation (Stefano Garzarella)
- cgroup: Fix compilation issue due to cgroup_mutex not being exported (Gao Xu)
- dma-mapping: avoid potential unused data compilation warning (Marek Szyprowski)
- mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type (Hans de Goede)
- intel_th: avoid using deprecated page-&gt;mapping, index fields (Lorenzo Stoakes)
- dma/mapping.c: dev_dbg support for dma_addressing_limited (Balbir Singh)
- virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han) [Orabug: 38094958] {CVE-2025-38048}
- scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices (Manish Pandey)
- scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [Orabug: 38095134] {CVE-2025-38075}
- nvmem: qfprom: switch to 4-byte aligned reads (Dmitry Baryshkov)
- nvmem: core: update raw_len if the bit reading is required (Dmitry Baryshkov)
- nvmem: core: verify cell's raw_len (Dmitry Baryshkov)
- nvmem: core: fix bit offsets of more than one byte (Dmitry Baryshkov)
- nvmem: rockchip-otp: add rk3576 variant data (Heiko Stuebner)
- nvmem: rockchip-otp: Move read-offset into variant-data (Heiko Stuebner)
- cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist (Pengyu Luo)
- phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Move IRQ request in probe (Claudiu Beznea)
- i2c: designware: Fix an error handling path in i2c_dw_pci_probe() (Christophe Jaillet)
- i2c: designware: Use temporary variable for struct device (Andy Shevchenko)
- drm/amd/display: Defer BW-optimization-blocked DRR adjustments (John Olender)
- drm/amd/display: Correct timing_adjust_pending flag setting. (Zhongwei)
- drm/amd/display: Do not enable replay when vtotal update is pending. (Sung-Huai Wang)
- drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401 (Dillon Varone)
- LTS version: v6.12.30 (Jack Vogel)
- drm/amdgpu: fix pm notifier handling (Alex Deucher)
- phy: tegra: xusb: remove a stray unlock (Dan Carpenter)
- usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977018] {CVE-2025-37967}
- drm/tiny: panel-mipi-dbi: Use drm_client_setup_with_fourcc() (Fabio Estevam)
- drm/panel-mipi-dbi: Run DRM default client setup (Thomas Zimmermann)
- drm/fbdev-dma: Support struct drm_driver.fbdev_probe (Thomas Zimmermann)
- Bluetooth: btnxpuart: Fix kernel panic during FW release (Neeraj Sanjay Kale) [Orabug: 37844459] {CVE-2025-22102}
- iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977026] {CVE-2025-37968}
- accel/ivpu: Fix fw log printing (Jacek Lawrynowicz)
- accel/ivpu: Refactor functions in ivpu_fw_log.c (Jacek Lawrynowicz)
- accel/ivpu: Reset fw log on cold boot (Tomasz Rusinowicz)
- accel/ivpu: Rename ivpu_log_level to fw_log_level (Jacek Lawrynowicz)
- mm/page_alloc: fix race condition in unaccepted memory handling (Kirill A. Shutemov) [Orabug: 38094767] {CVE-2025-38008}
- drm/xe/gsc: do not flush the GSC worker from the reset path (Daniele Ceraolo Spurio)
- CIFS: New mount option for cifs.upcall namespace resolution (Ritvik Budhiraja)
- dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (Shuai Xue) [Orabug: 38094790] {CVE-2025-38014}
- dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094793] {CVE-2025-38015}
- dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call (Shuai Xue)
- dmaengine: idxd: Add missing cleanups in cleanup internals (Shuai Xue)
- dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs (Shuai Xue)
- dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy (Yemike Abhilash Chandra)
- dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094756] {CVE-2025-38005}
- mm: userfaultfd: correct dirty flags set for both present and swap pte (Barry Song)
- net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
- ring-buffer: Fix persistent buffer when commit page is the reader page (Steven Rostedt)
- wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094770] {CVE-2025-38009}
- tpm: Mask TPM RC in tpm2_start_auth_session() (Jarkko Sakkinen)
- spi: tegra114: Use value to check for invalid delays (Aaron Kling)
- smb: client: fix memory leak during error handling for POSIX mkdir (Jethro Donaldson)
- scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer (Steve Siwinski)
- phy: renesas: rcar-gen3-usb2: Set timing registers only once (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind (Claudiu Beznea)
- phy: Fix error handling in tegra_xusb_port_init (Ma Ke)
- phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking (Wayne Chang) [Orabug: 38094777] {CVE-2025-38010}
- tracing: samples: Initialize trace_array_printk() with the correct function (Steven Rostedt)
- ftrace: Fix preemption accounting for stacktrace filter command (Donglin Peng)
- ftrace: Fix preemption accounting for stacktrace trigger command (Donglin Peng)
- kbuild: Disable -Wdefault-const-init-unsafe (Nathan Chancellor)
- Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer() (Michael Kelley)
- Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (Michael Kelley)
- arm64: dts: rockchip: Remove overdrive-mode OPPs from RK3588J SoC dtsi (Dragan Simic)
- arm64: dts: amlogic: dreambox: fix missing clkc_audio node (Christian Hewitt)
- hv_netvsc: Remove rmsg_pgcnt (Michael Kelley)
- hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (Michael Kelley)
- hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (Michael Kelley)
- dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi)
- ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera (Nicolas Chauvet)
- ALSA: usb-audio: Add sample rate quirk for Audioengine D1 (Christian Heusel)
- ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() (Xu Wang)
- ACPI: PPTT: Fix processor subtable walk (Jeremy Linton)
- gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
- MAINTAINERS: Update Alexey Makhalov's email address (Alexey Makhalov)
- drm/amd/display: Avoid flooding unnecessary info messages (Wayne Lin)
- drm/amd/display: Correct the reply value when AUX write incomplete (Wayne Lin)
- drm/amdgpu: csa unmap use uninterruptible lock (Philip Yang) [Orabug: 38094779] {CVE-2025-38011}
- drm/amdgpu: fix incorrect MALL size for GFX1151 (Tim Huang)
- Revert "drm/amd/display: Hardware cursor changes color when switched to software cursor" (Melissa Wen)
- btrfs: add back warning for mount option commit values exceeding 300 (Kyoji Ogasawara)
- btrfs: fix folio leak in submit_one_async_extent() (Boris Burkov)
- btrfs: fix discard worker infinite loop after disabling discard (Filipe Manana)
- LoongArch: uprobes: Remove redundant code about resume_era (Tiezhu Yang)
- LoongArch: uprobes: Remove user_{en,dis}able_single_step() (Tiezhu Yang)
- LoongArch: Fix MAX_REG_OFFSET calculation (Huacai Chen)
- LoongArch: Save and restore CSR.CNTC for hibernation (Huacai Chen)
- LoongArch: Move __arch_cpu_idle() to .cpuidle.text section (Huacai Chen)
- LoongArch: Prevent cond_resched() occurring within kernel-fpu (Tianyang Zhang)
- HID: bpf: abort dispatch if device destroyed (Rongrong) [Orabug: 38094796] {CVE-2025-38016}
- udf: Make sure i_lenExtents is uptodate on inode eviction (Jan Kara)
- sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator (Tejun Heo) [Orabug: 38094786] {CVE-2025-38012}
- dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" (Nathan Lynch)
- NFSv4/pnfs: Reset the layout state after a layoutreturn (Trond Myklebust)
- tsnep: fix timestamping with a stacked DSA driver (Gerhard Engleder)
- net/tls: fix kernel panic when alloc_page failed (Pengtao He) [Orabug: 38094802] {CVE-2025-38018}
- mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (Ido Schimmel) [Orabug: 38094804] {CVE-2025-38019}
- wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request (Kees Cook) [Orabug: 38094788] {CVE-2025-38013}
- octeontx2-pf: Do not reallocate all ntuple filters (Subbaraya Sundeep)
- octeontx2-af: Fix CGX Receive counters (Hariprasad Kelam)
- net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability (Bc-Bocun Chen)
- octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy (Subbaraya Sundeep)
- netlink: specs: tc: all actions are indexed arrays (Jakub Kicinski)
- netlink: specs: tc: fix a couple of attribute names (Jakub Kicinski)
- drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value (Umesh Nerlige Ramappa)
- regulator: max20086: fix invalid memory access (Cosmin Tanislav) [Orabug: 38094833] {CVE-2025-38027}
- qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() (Abdun Nihaal)
- net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094808] {CVE-2025-38020}
- vsock/test: Fix occasional failure in SIOCOUTQ tests (Konstantin Shkolnyy)
- net: dsa: b53: prevent standalone from trying to forward to other ports (Jonas Gorski)
- ALSA: sh: SND_AICA should depend on SH_DMA_API (Geert Uytterhoeven)
- nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (Keith Busch)
- nvme-pci: make nvme_pci_npages_prp() __always_inline (Kees Cook)
- net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING (Vladimir Oltean)
- net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe)
- ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info (Takashi Iwai)
- ALSA: seq: Fix delivery of UMP events to group ports (Takashi Iwai)
- net: mctp: Ensure keys maintain only one ref to corresponding dev (Andrew Jeffery)
- tests/ncdevmem: Fix double-free of queue array (Cosmin Ratiu)
- selftests: ncdevmem: Switch to AF_INET6 (Stanislav Fomichev)
- selftests: ncdevmem: Make client_ip optional (Stanislav Fomichev)
- selftests: ncdevmem: Unify error handling (Stanislav Fomichev)
- selftests: ncdevmem: Separate out dmabuf provider (Stanislav Fomichev)
- selftests: ncdevmem: Redirect all non-payload output to stderr (Stanislav Fomichev)
- net: mctp: Don't access ifa_index when missing (Matt Johnston)
- mctp: no longer rely on net-&gt;dev_index_head[] (Eric Dumazet)
- tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing (Hangbin Liu)
- net_sched: Flush gso_skb list too during -&gt;change() (Cong Wang) [Orabug: 37998128] {CVE-2025-37992}
- Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags (Luiz Augusto von Dentz)
- RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Zhu Yanjun) [Orabug: 38094813] {CVE-2025-38022}
- spi: loopback-test: Do not split 1024-byte hexdumps (Geert Uytterhoeven)
- nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094818] {CVE-2025-38023}
- HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 38094764] {CVE-2025-38007}
- HID: thrustmaster: fix memory leak in thrustmaster_interrupts() (Qasim Ijaz)
- RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094827] {CVE-2025-38024}
- virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx (Koichiro Den)
- virtio_ring: add a func argument 'recycle_done' to virtqueue_reset() (Koichiro Den)
- iio: chemical: sps30: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7768-1: Fix insufficient alignment of timestamp. (Jonathan Cameron)
- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
- xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
- Revert "drm/amd: Stop evicting resources on APUs in suspend" (Alex Deucher)
- drm/amd: Add Suspend/Hibernate notification callback support (Mario Limonciello)
- iio: pressure: mprls0025pa: use aligned_s64 for timestamp (David Lechner)
- iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7266: Fix potential timestamp alignment issue. (Jonathan Cameron)
- KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (Sean Christopherson)
- KVM: Add member to struct kvm_gfn_range to indicate private/shared (Isaku Yamahata)
- uio_hv_generic: Fix sysfs creation path for ring buffer (Naman Jain)
- tpm: tis: Double the timeout B to 4s (Michal Suchanek)
- tracing: probes: Fix a possible race in trace_probe_log APIs (Masami Hiramatsu)
- cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks (Waiman Long)
- arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout (Himanshu Bhavani)
- platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection (Hans de Goede)
- platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL) (Runhua He)
- binfmt_elf: Move brk for static PIE even if ASLR disabled (Kees Cook)
- riscv: dts: sophgo: fix DMA data-width configuration for CV18xx (Ze Huang)
- drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies (Mario Limonciello)
- drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC Policies (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list to always include security.* xattrs (Stephen Smalley)
- arm64: dts: rockchip: Assign RT5616 MCLK rate on rk3588-friendlyelec-cm3588 (Tom Vincent)
- LTS version: v6.12.29 (Jack Vogel)
- arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977004] {CVE-2025-37963}
- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976926] {CVE-2025-37948}
- arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
- arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
- arm64: insn: Add support for encoding DSB (James Morse)
- mm: page_alloc: speed up fallbacks in rmqueue_bulk() (Johannes Weiner)
- mm: page_alloc: don't steal single pages from biggest buddy (Johannes Weiner)
- Bluetooth: btmtk: Remove the resetting step before downloading the fw (Hao Qin)
- Bluetooth: btmtk: Remove resetting mt7921 before downloading the fw (Hao Qin)
- io_uring: always arm linked timeouts prior to issue (Jens Axboe)
- rust: clean Rust 1.88.0's `clippy::uninlined_format_args` lint (Miguel Ojeda)
- rust: allow Rust 1.87.0's `clippy::ptr_eq` lint (Miguel Ojeda)
- Revert "um: work around sched_yield not yielding in time-travel mode" (Christian Lamparter)
- do_umount(): add missing barrier before refcount checks in sync case (Al Viro)
- io_uring/sqpoll: Increase task_work submission batch size (Gabriel Krisman Bertazi)
- drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs (Tejas Upadhyay)
- drm/xe/tests/mocs: Update xe_force_wake_get() return handling (Himal Prasad Ghimiray)
- riscv: misaligned: enable IRQs while handling misaligned accesses (Clément Léger)
- riscv: misaligned: factorize trap handling (Clément Léger)
- nvme: unblock ctrl state transition for firmware update (Daniel Wagner)
- drm/panel: simple: Update timings for AUO G101EVN010 (Kevin Baker)
- loop: Add sanity check for read/write_iter (Lizhi Xu)
- loop: factor out a loop_assign_backing_file helper (Christoph Hellwig)
- loop: refactor queue limits updates (Christoph Hellwig)
- loop: Fix ABBA locking race (Ogawa Hirofumi)
- loop: Simplify discard granularity calc (John Garry)
- loop: Use bdev limit helpers for configuring discard (John Garry)
- riscv: misaligned: Add handling for ZCB instructions (Nylon Chen)
- MIPS: Fix MAX_REG_OFFSET (Thorsten Blum)
- iio: adc: dln2: Use aligned_s64 for timestamp (Jonathan Cameron)
- iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64 (Jonathan Cameron)
- types: Complement the aligned types with signed 64-bit one (Andy Shevchenko)
- iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer. (Jonathan Cameron)
- iio: accel: adxl367: fix setting odr for activity time update (Lothar Rubusch)
- usb: usbtmc: Fix erroneous generic_read ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous wait_srq ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous get_stb ioctl error returns (Dave Penkler)
- USB: usbtmc: use interruptible sleep in usbtmc_read (Oliver Neukum)
- usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015126] {CVE-2025-37994}
- usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition (Rd Babiera)
- usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs (Lukasz Czechowski)
- usb: host: tegra: Prevent host controller crash when OTG port is used (Jim Lin)
- usb: gadget: Use get_status callback to set remote wakeup capability (Prashanth K)
- usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN (Wayne Chang)
- usb: gadget: f_ecm: Add get_status callback (Prashanth K)
- usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version (Pawel Laszczak)
- usb: cdnsp: Fix issue with resuming from L1 (Pawel Laszczak)
- usb: dwc3: gadget: Make gadget_wakeup asynchronous (Prashanth K)
- x86/microcode: Consolidate the loader enablement checking (Borislav Petkov)
- module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015131] {CVE-2025-37995}
- memblock: Accept allocated memory before use in memblock_double_array() (Tom Lendacky) [Orabug: 37976994] {CVE-2025-37960}
- clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() (Sebastian Andrzej Siewior)
- arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong idmap generation (Levi Yun)
- accel/ivpu: Increase state dump msg timeout (Jacek Lawrynowicz)
- xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976934] {CVE-2025-37949}
- xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it (John Ernberg)
- smb: client: Avoid race in open_cached_dir with lease breaks (Paul Aurich) [Orabug: 37976959] {CVE-2025-37954}
- usb: uhci-platform: Make the clock really optional (Alexey Charkov)
- drm/amdgpu/hdp7: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amd/display: Copy AUX read reply data whenever length &gt; 0 (Wayne Lin)
- drm/amd/display: Fix wrong handling for AUX_DEFER case (Wayne Lin)
- drm/amd/display: Remove incorrect checking in dmub aux handler (Wayne Lin)
- drm/amd/display: Fix the checking condition in dmub aux handling (Wayne Lin)
- drm/amd/display: more liberal vmin/vmax update for freesync (Aurabindo Pillai)
- drm/amd/display: Fix invalid context error in dml helper (Roman Li) [Orabug: 37977185] {CVE-2025-37965}
- drm/amdgpu/vcn: using separate VCN1_AON_SOC offset (Ruijing Dong)
- drm/xe: Add page queue multiplier (Matthew Brost)
- drm/v3d: Add job to pending list if the reset was skipped (Maíra Canal) [Orabug: 37976942] {CVE-2025-37951}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug: 37977031] {CVE-2025-37969}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977037] {CVE-2025-37970}
- iio: imu: inv_mpu6050: align buffer for timestamp (David Lechner)
- iio: adis16201: Correct inclinometer channel resolution (Gabriel)
- iio: adc: rockchip: Fix clock initialization sequence (Simon Xue)
- iio: adc: ad7606: fix serial register access (Angelo Dureghello)
- io_uring: ensure deferred completions are flushed for multishot (Jens Axboe)
- drm/amd/display: Shift DMUB AUX reply command if necessary (Wayne Lin)
- KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (Mikhail Lobanov) [Orabug: 37976977] {CVE-2025-37957}
- selftests/mm: fix a build failure on powerpc (Nysal Jan K.A.)
- selftests/mm: compaction_test: support platform with huge mount of memory (Feng Tang)
- mm/userfaultfd: fix uninitialized output field for -EAGAIN race (Peter Xu)
- mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976982] {CVE-2025-37958}
- mm: fix folio_pte_batch() on XEN PV (Petr Vaněk)
- x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (Dave Hansen) [Orabug: 37977013] {CVE-2025-37964}
- staging: axis-fifo: Correct handling of tx_fifo_depth for size validation (Gabriel)
- staging: axis-fifo: Remove hardware resets for user errors (Gabriel)
- staging: bcm2835-camera: Initialise dev in v4l2_dev (Dave Stevenson) [Orabug: 37977042] {CVE-2025-37971}
- staging: iio: adc: ad7816: Correct conditional logic for store mode (Gabriel)
- rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.87.0 (Miguel Ojeda)
- rust: clean Rust 1.88.0's `unnecessary_transmutes` lint (Miguel Ojeda)
- Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 (Aditya Garg)
- Input: synaptics - enable SMBus for HP Elitebook 850 G1 (Dmitry Torokhov)
- Input: synaptics - enable InterTouch on Dell Precision M3800 (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30L-G (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30-D (Manuel Fombuena)
- Input: xpad - fix two controller table values (Vicki Pfau)
- Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller (Lode Willems)
- Input: xpad - fix Share button on Xbox One controllers (Vicki Pfau)
- Input: mtk-pmic-keys - fix possible null pointer dereference (Gary Bisson) [Orabug: 37977044] {CVE-2025-37972}
- Input: cyttsp5 - fix power control issue on wakeup (Mikael Gonella-Bolduc)
- Input: cyttsp5 - ensure minimum reset pulse width (Hugo Villeneuve)
- virtio-net: fix total qstat values (Jakub Kicinski)
- net: export a helper for adding up queue stats (Jakub Kicinski)
- fbnic: Do not allow mailbox to toggle to ready outside fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Pull fbnic_fw_xmit_cap_msg use out of interrupt context (Alexander Duyck)
- fbnic: Improve responsiveness of fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Actually flush_tx instead of stalling out (Alexander Duyck)
- fbnic: Gate AXI read/write enabling on FW mailbox (Alexander Duyck)
- fbnic: Fix initialization of mailbox descriptor rings (Alexander Duyck)
- net: dsa: b53: do not set learning and unicast/multicast on up (Jonas Gorski)
- net: dsa: b53: fix learning on VLAN unaware bridges (Jonas Gorski)
- net: dsa: b53: fix toggling vlan_filtering (Jonas Gorski)
- net: dsa: b53: do not program vlans when vlan filtering is off (Jonas Gorski)
- net: dsa: b53: do not allow to configure VLAN 0 (Jonas Gorski)
- net: dsa: b53: always rejoin default untagged VLAN on bridge leave (Jonas Gorski)
- net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave (Jonas Gorski)
- net: dsa: b53: fix flushing old pvid VLAN on pvid change (Jonas Gorski)
- net: dsa: b53: fix clearing PVID of a port (Jonas Gorski)
- net: dsa: b53: keep CPU port always tagged again (Jonas Gorski)
- net: dsa: b53: allow leaky reserved multicast (Jonas Gorski)
- bpf: Scrub packet on bpf_redirect_peer (Paul Chaignon) [Orabug: 37976990] {CVE-2025-37959}
- netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015141] {CVE-2025-37997}
- ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [Orabug: 37976996] {CVE-2025-37961}
- erofs: ensure the extra temporary copy is valid for shortened bvecs (Gao Xiang)
- ice: use DSN instead of PCI BDF for ice_adapter index (Przemek Kitszel)
- ice: Initial support for E825C hardware in ice_adapter (Sergey Temerkhanov)
- wifi: mac80211: fix the type of status_code for negotiated TID to Link Mapping (Michael-Cy Lee)
- can: gw: fix RCU/BH usage in cgw_create_job() (Oliver Hartkopp)
- can: mcp251xfd: fix TDC setting for low data bit rates (Kelsey Maes)
- can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe (Antonios Salios) [Orabug: 38015123] {CVE-2025-37993}
- net: ethernet: mtk_eth_soc: do not reset PSE when setting FE (Frank Wunderlich)
- net: ethernet: mtk_eth_soc: reset all TX queues on DMA free (Daniel Golle)
- gre: Fix again IPv6 link-local address generation. (Guillaume Nault)
- virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (Jakub Kicinski) [Orabug: 37976969] {CVE-2025-37955}
- virtio_net: xsk: bind/unbind xsk for tx (Xuan Zhuo)
- sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 37977176] {CVE-2025-37953}
- s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
- ksmbd: fix memory leak in parse_lease_state() (Zhaolong Wang) [Orabug: 37977180] {CVE-2025-37962}
- openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015148] {CVE-2025-37998}
- ksmbd: Fix UAF in __close_file_table_ids (Sean Heelan) [Orabug: 37976951] {CVE-2025-37952}
- ksmbd: prevent out-of-bounds stream writes by validating *pos (Norbert Szetei) [Orabug: 37976923] {CVE-2025-37947}
- ksmbd: prevent rename with empty string (Namjae Jeon) [Orabug: 37976972] {CVE-2025-37956}
- can: rockchip_canfd: rkcanfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Niklas Schnelle) [Orabug: 37976920] {CVE-2025-37946}
- vfio/pci: Align huge faults to order (Alex Williamson)
- wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation (Veerendranath Jakkam) [Orabug: 37977046] {CVE-2025-37973}
- s390/pci: Fix missing check for zpci_create_device() error return (Niklas Schnelle) [Orabug: 37977050] {CVE-2025-37974}
- can: mcan: m_can_class_unregister(): fix order of unregistration calls (Marc Kleine-Budde)
- firmware: arm_scmi: Fix timeout checks on polling path (Cristian Marussi)
- arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2 (Wojciech Dubowik)
- Revert "btrfs: canonicalize the device path before adding it" (Qu Wenruo)
- fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (Max Kellermann) [Orabug: 38015155] {CVE-2025-37999}
- dm: add missing unlock on in dm_keyslot_evict() (Dan Carpenter)
- mm/vmscan: wake up flushers conditionally to avoid cgroup OOM (Zeng Jingxiang) [Orabug: 37480932]
- dmaengine: idxd: Narrow the restriction on BATCH to ver. 1 only (Vinicius Costa Gomes) [Orabug: 37801355]
- uek-rpm: build the fwctl mlx5 driver on UEK (Qing Huang) [Orabug: 37810636]
- fwctl: Adapt upstream code for UEK8 (Mikhael Goikhman) [Orabug: 37810636]
- mlx5: Create an auxiliary device for fwctl_mlx5 (Saeed Mahameed) [Orabug: 37810636]
- fwctl/mlx5: Support for communicating with mlx5 fw (Saeed Mahameed) [Orabug: 37810636]
- fwctl: Add documentation (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware (Jason Gunthorpe) [Orabug: 37810636]
- taint: Add TAINT_FWCTL (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_INFO to return basic information about the device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Basic ioctl dispatch for the character device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Add basic structure for a class subsystem with a cdev (Jason Gunthorpe) [Orabug: 37810636]
- Revert "fwctl: Add basic structure for a class subsystem with a cdev" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Basic ioctl dispatch for the character device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_INFO to return basic information about the device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Support for communicating with mlx5 fw" (Qing Huang) [Orabug: 37810636]
- Revert "mlx5: Create an auxiliary device for fwctl_mlx5" (Qing Huang) [Orabug: 37810636]
- Revert "taint: Add TAINT_FWCTL" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Adapt code for UEK-NEXT" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Add INTERNAL_DEV_RES uctx capability" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Allow up to 4k devices" (Qing Huang) [Orabug: 37810636]
- Revert "uek-rpm: build the fwctl mlx5 driver on UEK" (Qing Huang) [Orabug: 37810636]
- dmaengine: idxd: Change err messages to dbg (Jack Vogel) [Orabug: 37841831]
- PCI: Add PCI_VDEVICE_SUB helper macro (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbevf: Add support for Intel(R) E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Enable link management in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Clean up the E610 link management related code (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add ixgbe_x540 multiple header inclusion protection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for EEPROM dump in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for NVM handling in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add link management support for E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 device capabilities detection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 FW Admin Command Interface (Piotr Kwapulinski) [Orabug: 37889575]
- uek-rpm: Move the gve kernel module from extra to kernel-uek-core (Samasth Norway Ananda) [Orabug: 37940897]
- uek-rpm/config-aarch64: Enable BT_HCIUART_BCM for RPi Bluetooth (Vijay Kumar) [Orabug: 37961540]
- platform/mellanox: mlxbf-pmc: Support additional PMC blocks (Shravan Kumar Ramani) [Orabug: 37964051]
- mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug: 37964051,38037120] {CVE-2025-37866}
- mlxbf-bootctl: Support sysfs entries for RTC battery status (Xiangrong Li) [Orabug: 37964051]
- platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37964051]
- uek-rpm: CONFIG_PTP_1588_CLOCK_OCP enable for OCI (Vijayendra Suman) [Orabug: 37966384]
- x86/its: Fix build errors when CONFIG_MODULES=n (Eric Biggers) [Orabug: 37970148]
- x86/its: Use dynamic thunks for indirect branches (Peter Zijlstra) [Orabug: 37970148]
- x86/ibt: Keep IBT disabled during alternative patching (Pawan Gupta) [Orabug: 37970148]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 37989268]
- amd_hsmp: Increase the SMU timeout to 500ms (Vijay Kumar) [Orabug: 38000074]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge)  [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang)  [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming)  [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams)  [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson)  [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley)  [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson)  [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson)  [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang)  [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang)  [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang)  [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang)  [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang)  [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang)  [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie)  [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie)  [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen)  [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen)  [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda)  [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda)  [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.1.el10uek]" date="1750939200">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.2.el10uek]" date="1752148800">- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38178286]  {CVE-2025-38089}
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38162790]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38175263]
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)  [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)  [Orabug: 38175246]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.3.el10uek]" date="1752494400">- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38171405]</changelog>
</package>
<package pkgid="bacd7182148f8447ba73e6ac7b7a59ae658f5c08" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="102.36.5.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge) [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang) [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming) [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams) [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson) [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley) [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson) [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson) [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang) [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang) [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang) [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang) [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang) [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang) [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie) [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie) [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen) [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen) [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda) [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda) [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger)  [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan)  [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan)  [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin)
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota)
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu)
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng)
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann)
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo)
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov)
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu)
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi)
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung)
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei Zhang)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Wentao Liang)
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold)
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-ji Chen)
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu)
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett)
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana)
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li (Intel))
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells)
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara)
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko)
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima)
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai)
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee)
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima)
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet)
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer)
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai)
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin)
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (SeongJae Park)
- smb: client: remove 	 from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima)
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski)
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev)
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo)
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski)
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang)
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin.Cao)
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng)
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke)
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun)
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (FUJITA Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin KaFai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu)
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra)
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher)
- smb: client: fix first command failure during re-negotiation (zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich)
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet)
- net: atm: add lec_mutex (Eric Dumazet)
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima)
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg)
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev)
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski)
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu)
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima)
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima)
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov)
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo)
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh AP)
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon)
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka)
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders)
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sá)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott)
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath SM)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal)
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn)
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis)
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam)
- Input: sparcspkr - avoid unannotated fall-through (WangYuli)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar)
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima)
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rong Zhang)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon)
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li (Intel))
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski)
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet)
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath SM)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin)
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov)
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang)
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton)
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes)
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook)
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Wentao Liang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij)
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo)
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner)
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu)
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh AP)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso)
- f2fs: fix to bail out in get_new_segment() (Chao Yu)
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski)
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R)
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin)
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao)
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S)
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (gldrk)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han)
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han)
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn)
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos)
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang)
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang)
- regulator: max14577: Add error check for max14577_read_reg() (Wentao Liang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel Shahrouzi)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann)
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz)
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin)
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Wentao Liang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Wentao Liang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams)
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'ichiro Kawasaki)
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park)
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (GONG Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu)
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim)
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski)
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han)
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu)
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim)
- f2fs: fix to do sanity check on ino and xnid (Chao Yu)
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter)
- ext4: only dirty folios when data journaling regular files (Brian Foster)
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo)
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis)
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko)
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin)
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeff Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar)
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski)
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian)
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev)
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis)
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li)
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Wentao Liang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis)
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park)
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann)
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng)
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (NeilBrown)
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh)
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter)
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Wentao Liang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Wentao Liang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Wentao Liang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F. R. A. Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li (Intel))
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner)
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov)
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt)
- 9p: Add a migrate_folio method (Matthew Wilcox (Oracle))
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (RD Babiera)
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby (SUSE))
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Wupeng Ma)
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard)
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov)
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge)
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox (Oracle))
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox (Oracle))
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig)
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang)
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana)
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski)
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet)
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet)
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet)
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin)
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz)
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski)
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski)
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj)
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui)
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani (IBM))
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet)
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang)
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park)
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz)
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav)
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold)
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro)
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki NAGAO)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski)
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel)
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal)
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari)
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song)
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng)
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré)
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré)
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak)
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas)
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen)
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Yeoreum Yun)
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz)
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (WangYuli)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang)
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin)
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar)
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin)
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang)
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng)
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe JAILLET)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe JAILLET)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski)
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin)
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov)
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin)
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov)
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin)
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei)
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Wentao Liang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher)
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F. R. A. Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo)
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima)
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam)
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur)
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang)
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (KaFai Wan)
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein)
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich)
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen)
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook)
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li RongQing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin)
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin)
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný)
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (ping.gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen)
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu)
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu)
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev)
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring (Arm))
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen)
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko)
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin)
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (YiFei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad)
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso)
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang)
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan)
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma)
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen XIN)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen XIN)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu)
- f2fs: prevent the current section from being selected as a victim during GC (yohan.joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter)
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu)
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen)
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen)
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang)
- xen/x86: fix initial memory balloon target (Roger Pau Monne)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon)
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A. R. Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin)
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe JAILLET)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao)
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao)
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland)
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown)
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han)
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian)
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo)
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot)
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong)
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu)
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F. R. A. Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu (Google))
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby (SUSE))
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait)
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper)
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli)  [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha)  [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137447]  {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky)  [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli)  [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly)  [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry)  [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson)  [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson)  [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry)  [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry)  [Orabug: 38026089]
- xfs: update atomic write limits (John Garry)  [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry)  [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry)  [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry)  [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry)  [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry)  [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong)  [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong)  [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry)  [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong)  [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry)  [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong)  [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong)  [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig)  [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig)  [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry)  [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry)  [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry)  [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry)  [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry)  [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry)  [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry)  [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry)  [Orabug: 38026089]
- dm-table: atomic writes support (John Garry)  [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry)  [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry)  [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry)  [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry)  [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry)  [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry)  [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry)  [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry)  [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry)  [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry)  [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry)  [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry)  [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry)  [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry)  [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry)  [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry)  [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen)  [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge)  [Orabug: 38137957]
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge)  [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge)  [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna)  [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju)  [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.1.el10uek]" date="1754481600">- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann)  [Orabug: 38217337]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.2.el10uek]" date="1755086400">- iommu/vt-d: Fix misplaced domain_attached assignment (Ban ZuoXiang)  [Orabug: 38294635]</changelog>
</package>
<package pkgid="3c647fb896a53363e3e61ced6646e5a39a341a8c" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="102.36.5.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge) [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang) [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming) [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams) [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson) [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley) [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson) [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson) [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang) [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang) [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang) [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang) [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang) [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang) [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie) [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie) [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen) [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen) [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda) [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda) [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger)  [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan)  [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan)  [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin)
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota)
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu)
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng)
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann)
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo)
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov)
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu)
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi)
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung)
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei Zhang)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Wentao Liang)
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold)
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-ji Chen)
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu)
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett)
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana)
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li (Intel))
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells)
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara)
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko)
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima)
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai)
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee)
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima)
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet)
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer)
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai)
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin)
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (SeongJae Park)
- smb: client: remove 	 from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima)
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski)
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev)
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo)
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski)
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang)
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin.Cao)
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng)
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke)
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun)
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (FUJITA Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin KaFai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu)
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra)
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher)
- smb: client: fix first command failure during re-negotiation (zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich)
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet)
- net: atm: add lec_mutex (Eric Dumazet)
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima)
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg)
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev)
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski)
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu)
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima)
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima)
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov)
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo)
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh AP)
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon)
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka)
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders)
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sá)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott)
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath SM)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal)
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn)
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis)
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam)
- Input: sparcspkr - avoid unannotated fall-through (WangYuli)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar)
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima)
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rong Zhang)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon)
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li (Intel))
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski)
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet)
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath SM)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin)
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov)
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang)
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton)
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes)
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook)
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Wentao Liang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij)
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo)
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner)
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu)
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh AP)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso)
- f2fs: fix to bail out in get_new_segment() (Chao Yu)
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski)
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R)
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin)
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao)
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S)
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (gldrk)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han)
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han)
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn)
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos)
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang)
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang)
- regulator: max14577: Add error check for max14577_read_reg() (Wentao Liang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel Shahrouzi)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann)
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz)
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin)
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Wentao Liang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Wentao Liang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams)
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'ichiro Kawasaki)
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park)
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (GONG Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu)
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim)
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski)
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han)
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu)
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim)
- f2fs: fix to do sanity check on ino and xnid (Chao Yu)
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter)
- ext4: only dirty folios when data journaling regular files (Brian Foster)
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo)
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis)
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko)
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin)
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeff Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar)
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski)
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian)
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev)
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis)
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li)
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Wentao Liang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis)
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park)
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann)
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng)
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (NeilBrown)
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh)
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter)
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Wentao Liang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Wentao Liang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Wentao Liang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F. R. A. Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li (Intel))
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner)
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov)
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt)
- 9p: Add a migrate_folio method (Matthew Wilcox (Oracle))
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (RD Babiera)
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby (SUSE))
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Wupeng Ma)
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard)
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov)
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge)
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox (Oracle))
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox (Oracle))
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig)
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang)
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana)
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski)
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet)
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet)
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet)
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin)
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz)
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski)
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski)
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj)
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui)
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani (IBM))
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet)
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang)
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park)
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz)
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav)
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold)
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro)
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki NAGAO)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski)
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel)
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal)
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari)
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song)
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng)
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré)
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré)
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak)
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas)
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen)
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Yeoreum Yun)
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz)
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (WangYuli)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang)
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin)
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar)
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin)
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang)
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng)
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe JAILLET)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe JAILLET)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski)
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin)
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov)
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin)
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov)
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin)
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei)
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Wentao Liang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher)
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F. R. A. Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo)
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima)
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam)
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur)
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang)
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (KaFai Wan)
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein)
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich)
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen)
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook)
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li RongQing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin)
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin)
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný)
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (ping.gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen)
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu)
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu)
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev)
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring (Arm))
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen)
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko)
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin)
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (YiFei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad)
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso)
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang)
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan)
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma)
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen XIN)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen XIN)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu)
- f2fs: prevent the current section from being selected as a victim during GC (yohan.joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter)
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu)
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen)
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen)
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang)
- xen/x86: fix initial memory balloon target (Roger Pau Monne)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon)
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A. R. Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin)
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe JAILLET)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao)
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao)
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland)
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown)
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han)
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian)
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo)
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot)
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong)
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu)
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F. R. A. Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu (Google))
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby (SUSE))
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait)
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper)
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli)  [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha)  [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137447]  {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky)  [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli)  [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly)  [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry)  [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson)  [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson)  [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry)  [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry)  [Orabug: 38026089]
- xfs: update atomic write limits (John Garry)  [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry)  [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry)  [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry)  [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry)  [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry)  [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong)  [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong)  [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry)  [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong)  [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry)  [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong)  [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong)  [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig)  [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig)  [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry)  [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry)  [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry)  [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry)  [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry)  [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry)  [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry)  [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry)  [Orabug: 38026089]
- dm-table: atomic writes support (John Garry)  [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry)  [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry)  [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry)  [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry)  [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry)  [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry)  [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry)  [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry)  [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry)  [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry)  [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry)  [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry)  [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry)  [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry)  [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry)  [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry)  [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen)  [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge)  [Orabug: 38137957]
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge)  [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge)  [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna)  [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju)  [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.1.el10uek]" date="1754481600">- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann)  [Orabug: 38217337]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.2.el10uek]" date="1755086400">- iommu/vt-d: Fix misplaced domain_attached assignment (Ban ZuoXiang)  [Orabug: 38294635]</changelog>
</package>
<package pkgid="eb0ffeabff9ab449d45987cfd6c12371569e9ffc" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger) [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo) [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan) [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan) [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
</package>
<package pkgid="2fc4b23e09596b6f3afc8cd8bde5c277d8355b17" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="103.40.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger) [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo) [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan) [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan) [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
</package>
<package pkgid="90d42d125f43bb003062e6c1210607a782590db9" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]  
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
</package>
<package pkgid="36f37a26b6e33fd00457e0d61496cabd193ce8ff" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="103.40.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]  
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
</package>
<package pkgid="9aed2c7a0b414abc016c48e866cc8640c2802251" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560} 
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500} 
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566} 
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571} 
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618} 
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
</package>
<package pkgid="f72303c5d51a737b0edf1c551de47a2be904c37b" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="103.40.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560} 
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500} 
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566} 
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571} 
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618} 
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
</package>
<package pkgid="d3091ec2d11c7fec1b370e0afa00f8d75b033b57" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560}
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500}
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566}
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571}
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618}
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.4.el10uek]" date="1759492800">- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton)  [Orabug: 38500610]  {CVE-2025-38724} 
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38500621]  {CVE-2025-39698} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38500629]  {CVE-2025-39881} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38500632]  {CVE-2025-39866}</changelog>
</package>
<package pkgid="ebca31f9343c7b7d713770ed3dcf131232f88da0" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="103.40.4.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560}
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500}
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566}
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571}
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618}
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.4.el10uek]" date="1759492800">- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton)  [Orabug: 38500610]  {CVE-2025-38724} 
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38500621]  {CVE-2025-39698} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38500629]  {CVE-2025-39881} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38500632]  {CVE-2025-39866}</changelog>
</package>
<package pkgid="ee56ca602ff3472e2945436f135e846b09ddaf8a" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="104.43.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
</package>
<package pkgid="4202a7dc3c10207ef03d8c80728ebf44115bab83" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="104.43.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
</package>
<package pkgid="5ccd6c53e75d37941627814618753efb30584d53" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="104.43.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.3.el10uek]" date="1761220800">- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38572958]  {CVE-2025-39698} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38572953]  {CVE-2025-39866} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38572951]  {CVE-2025-3988} 
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon)  [Orabug: 38572950]  {CVE-2025-39718} 
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38572948]  {CVE-2025-39964} 
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)  [Orabug: 38572947]  {CVE-2025-39963} 
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)  [Orabug: 38572946]  {CVE-2025-39965} 
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski)  [Orabug: 38572944]  {CVE-2025-39946} 
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)  [Orabug: 38572943]  {CVE-2025-39977} 
- i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38572941]  {CVE-2025-39973}</changelog>
</package>
<package pkgid="87856da3df4aaf76639385c9fe08d2ef8cc36565" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="104.43.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.3.el10uek]" date="1761220800">- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38572958]  {CVE-2025-39698} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38572953]  {CVE-2025-39866} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38572951]  {CVE-2025-3988} 
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon)  [Orabug: 38572950]  {CVE-2025-39718} 
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38572948]  {CVE-2025-39964} 
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)  [Orabug: 38572947]  {CVE-2025-39963} 
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)  [Orabug: 38572946]  {CVE-2025-39965} 
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski)  [Orabug: 38572944]  {CVE-2025-39946} 
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)  [Orabug: 38572943]  {CVE-2025-39977} 
- i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38572941]  {CVE-2025-39973}</changelog>
</package>
<package pkgid="c9038e931f2bb1e21f8a46e83b1c101d45f3b6ea" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="105.51.5.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)
- media: rc: fix races with imon_disconnect() (Larshin Sergey)
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik)
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)
- i40e: add validation for ring_len param (Lukasz Czapnik)
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.1.el10uek]" date="1764590400">- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu)  [Orabug: 38712788]  {CVE-2025-40019} 
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712786]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="fabb9cb8e3f560c4159980206308d80a0d6e7bc8" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="105.51.5.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)
- media: rc: fix races with imon_disconnect() (Larshin Sergey)
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik)
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)
- i40e: add validation for ring_len param (Lukasz Czapnik)
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.1.el10uek]" date="1764590400">- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu)  [Orabug: 38712788]  {CVE-2025-40019} 
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712786]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="3dc746f3867245c0519925601a0fe7be189d6d2b" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="105.51.5.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]  
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]  
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]  
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]  
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]  
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]  
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]  
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]  
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]  
- LTS version: v6.12.51 (Jack Vogel)   
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)   
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)   
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)   
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)   
- media: rc: fix races with imon_disconnect() (Larshin Sergey)   
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)   
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)   
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)   
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)   
- crypto: sha256 - fix crash at kexec (Breno Leitao)   
- LTS version v6.12.50 (Jack Vogel)   
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)   
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)   
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)   
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)   
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)   
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)   
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)   
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)   
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)   
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)   
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)   
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)   
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)   
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)   
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))   
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)   
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)   
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)   
- i40e: add max boundary check for VF filters (Lukasz Czapnik)   
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)   
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)   
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)   
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)   
- i40e: add validation for ring_len param (Lukasz Czapnik)   
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)   
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)   
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)   
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)   
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)   
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)   
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)   
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)   
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)   
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)   
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)   
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)   
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)   
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)   
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)   
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)   
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)   
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)   
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)   
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)   
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)   
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)   
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)   
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)   
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)   
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)   
- wifi: virt_wifi: Fix page fault on connect (James Guan)   
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)   
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)   
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)   
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)   
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)   
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)   
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)   
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)   
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)   
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)   
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)   
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)   
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)   
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)   
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)   
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)   
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)   
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)   
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)   
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)   
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)   
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)   
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)   
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)   
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)   
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
</package>
<package pkgid="c44953c2b666537c5760fba45143bda0f437a8db" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="105.51.5.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]  
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]  
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]  
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]  
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]  
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]  
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]  
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]  
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]  
- LTS version: v6.12.51 (Jack Vogel)   
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)   
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)   
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)   
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)   
- media: rc: fix races with imon_disconnect() (Larshin Sergey)   
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)   
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)   
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)   
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)   
- crypto: sha256 - fix crash at kexec (Breno Leitao)   
- LTS version v6.12.50 (Jack Vogel)   
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)   
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)   
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)   
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)   
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)   
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)   
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)   
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)   
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)   
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)   
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)   
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)   
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)   
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)   
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))   
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)   
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)   
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)   
- i40e: add max boundary check for VF filters (Lukasz Czapnik)   
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)   
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)   
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)   
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)   
- i40e: add validation for ring_len param (Lukasz Czapnik)   
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)   
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)   
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)   
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)   
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)   
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)   
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)   
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)   
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)   
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)   
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)   
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)   
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)   
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)   
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)   
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)   
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)   
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)   
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)   
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)   
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)   
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)   
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)   
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)   
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)   
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)   
- wifi: virt_wifi: Fix page fault on connect (James Guan)   
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)   
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)   
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)   
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)   
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)   
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)   
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)   
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)   
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)   
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)   
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)   
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)   
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)   
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)   
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)   
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)   
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)   
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)   
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)   
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)   
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)   
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)   
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)   
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)   
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)   
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
</package>
<package pkgid="4175cd5cf39669e2fa4c4476d0a8063914c38bb0" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="106.55.4.1.el10uek"/>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="0805c742f61baff8d9b348fde549999ff937e377" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="106.55.4.1.el10uek"/>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="1fcca52fad76f5ef736d83905a3b07a58a54de6e" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="106.55.4.2.el10uek"/>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.2.el10uek]" date="1766145600">- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)   {CVE-2025-40271} 
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="75f2ba5c1754ffd91e29e7ac917b4eeedc1b3004" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="106.55.4.2.el10uek"/>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.2.el10uek]" date="1766145600">- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)   {CVE-2025-40271} 
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="088478c537e8519f21e156d677bc6a8926428462" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="2bb5767eb77db0d42ecd0ec76e3ebd03d951402c" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="107.59.3.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="6c210e5bda86bf1fe4a8d76dff4fdb03692e7f52" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
</package>
<package pkgid="4f7286d28b2400a0ee675cf37f60d70f2481a7a2" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="107.59.3.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
</package>
<package pkgid="fad4eca77b6d7d337351a229a293bdc003e3217b" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.4.el10uek]" date="1770292800">- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet)  [Orabug: 38932996]  {CVE-2025-40257} 
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38932973]  {CVE-2025-40149} 
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet)  [Orabug: 38932955]  {CVE-2025-40258} 
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38932939]</changelog>
</package>
<package pkgid="be737c93fa62b35f8888d33278c5f43359dd2da2" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="107.59.3.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.4.el10uek]" date="1770292800">- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet)  [Orabug: 38932996]  {CVE-2025-40257} 
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38932973]  {CVE-2025-40149} 
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet)  [Orabug: 38932955]  {CVE-2025-40258} 
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38932939]</changelog>
</package>
<package pkgid="7b26083bb1d845d72138b2542832b3aa1762e298" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="108.64.6.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge) [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp) [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal) [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.62.1.el10uek]" date="1765886400">- uek-rpm: Allow disabling kabichk at command line (Yifei Liu) [Orabug: 38733049]
- Revert "xfrm: Use xdo.dev instead of xdo.real_dev" (Jack Vogel) [Orabug: 38718730]
- Revert "net/mlx5: Fix IPsec cleanup over MPV device" (Jack Vogel) [Orabug: 38718730]
- LTS version: v6.12.62 (Jack Vogel)
- bus: mhi: host: pci_generic: Add Telit FN990B40 modem support (Daniele Palmas)
- bus: mhi: host: pci_generic: Add Telit FN920C04 modem support (Daniele Palmas)
- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (Navaneeth K)
- staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (Navaneeth K)
- staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (Navaneeth K)
- comedi: check device's attached status in compat ioctls (Nikita Zhandarovich)
- comedi: multiq3: sanitize config options in multiq3_attach() (Nikita Zhandarovich)
- comedi: c6xdigio: Fix invalid PNP driver unregistration (Ian Abbott)
- wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (Zenm Chen)
- wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1 (Zenm Chen)
- samples: work around glibc redefining some of our defines wrong (Linus Torvalds)
- LoongArch: Mask all interrupts during kexec/kdump (Huacai Chen)
- HID: elecom: Add support for ELECOM M-XT3URBK (018F) (Naoki Ueki)
- platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (Antheas Kapenekakis)
- platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (Antheas Kapenekakis)
- platform/x86: huawei-wmi: add keys for HONOR models (Ston Jia)
- HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (April Grimoire)
- platform/x86: acer-wmi: Ignore backlight event (Armin Wolf)
- pinctrl: qcom: msm: Fix deadlock in pinmux configuration (Praveen Talari)
- nvme: fix admin request_queue lifetime (Keith Busch) [Orabug: 38773611] {CVE-2025-68265}
- HID: hid-input: Extend Elan ignore battery quirk to USB (Mario Limonciello)
- bfs: Reconstruct file type when loading from disk (Tetsuo Handa)
- ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (Lushih Hsieh)
- drm/amdkfd: Fix GPU mappings for APU after prefetch (Harish Kasiviswanathan)
- smb: fix invalid username check in smb3_fs_context_parse_param() (Yiqi Sun)
- Bluetooth: btrtl: Avoid loading the config file on security chips (Max Chou)
- drm/vmwgfx: Use kref in vmw_bo_dirty (Ian Forbes)
- spi: imx: keep dma request disabled before dma transfer setup (Robin Gong)
- spi: xilinx: increase number of retries before declaring stall (Alvaro Gamez Machado)
- ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() (Song Liu)
- USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- serial: add support of CPCI cards (Magne Bruno)
- USB: serial: ftdi_sio: match on interface number for jtag (Johan Hovold)
- USB: serial: option: move Telit 0x10c7 composition in the right place (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FE910C04 new compositions (Fabio Porcedda)
- USB: serial: option: add Foxconn T99W760 (Slark Xiao)
- KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (Omar Sandoval) [Orabug: 38773578] {CVE-2025-68259}
- comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (Nikita Zhandarovich)
- ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (Alexey Nepomnyashih) [Orabug: 38773586] {CVE-2025-68261}
- locking/spinlock/debug: Fix data-race in do_raw_write_lock (Alexander Sverdlin)
- ksmbd: ipc: fix use-after-free in ipc_msg_send_request (Qianchang Zhao)
- ext4: refresh inline data size before write operations (Deepanshu Kartikey) [Orabug: 38773602] {CVE-2025-68264}
- jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (Ye Bin) [Orabug: 38792632] {CVE-2025-68337}
- Documentation: process: Also mention Sasha Levin as stable tree maintainer (Bagas Sanjaya)
- xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca)
- xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)
- Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca)
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca) [Orabug: 38730491,38854317] {CVE-2025-40215}
- LTS version: v6.12.61 (Jack Vogel)
- spi: spi-nxp-fspi: Check return value of devm_mutex_init() (Thomas Weißschuh)
- drm/i915/dp: Initialize the source OUI write timestamp always (Imre Deak)
- Revert "ACPI: Suppress misleading SPCR console message when SPCR table is absent" (Punit Agrawal)
- wifi: ath12k: correctly handle mcast packets for clients (Sarika Sharma)
- net: dsa: microchip: Free previously initialized ports on init failures (Bastien Curutchet)
- net: dsa: microchip: Do not execute PTP driver code for unsupported switches (Tristram Ha)
- drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (Thomas Zimmermann) [Orabug: 38773709] {CVE-2025-68296}
- net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() (Bastien Curutchet)
- KVM: SVM: Fix redundant updates of LBR MSR intercepts (Yosry Ahmed)
- KVM: nSVM: Fix and simplify LBR virtualization handling with nested (Yosry Ahmed)
- KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() (Yosry Ahmed)
- KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts() (Yosry Ahmed)
- mm/huge_memory: fix NULL pointer deference when splitting folio (Wei Yang) [Orabug: 38773700] {CVE-2025-68293}
- usb: gadget: udc: fix use-after-free in usb_gadget_state_work (Jimmy Hu) [Orabug: 38773635] {CVE-2025-68282}
- usb: udc: Add trace event for usb_gadget_set_state (Kuen-Han Tsai)
- can: rcar_canfd: Fix CAN-FD mode as default (Biju Das)
- usb: typec: ucsi: psy: Set max current to zero when disconnected (Jameson Thies)
- nfsd: Replace clamp_t in nfsd4_get_drc_mem() (Neil Brown)
- staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann)
- libceph: replace BUG_ON with bounds check for map-&gt;max_osd (Ziming Zhang) [Orabug: 38773641] {CVE-2025-68283}
- libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773648] {CVE-2025-68284}
- libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773654] {CVE-2025-68285}
- net: dsa: microchip: Don't free uninitialized ksz_irq (Bastien Curutchet)
- net: dsa: microchip: ptp: Fix checks on irq_find_mapping() (Bastien Curutchet)
- net: dsa: microchip: common: Fix checks on irq_find_mapping() (Bastien Curutchet)
- drm/amd/display: Don't change brightness for disabled connectors (Mario Limonciello)
- drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773661] {CVE-2025-68286}
- drm/amd/amdgpu: reserve vm invalidation engine for uni_mes (Michael Chen)
- drm: sti: fix device leaks at component probe (Johan Hovold)
- USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang)
- USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov)
- xhci: dbgtty: fix device unregister (Łukasz Bartosik)
- xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman)
- xhci: fix stale flag preventig URBs after link state error is cleared (Mathias Nyman)
- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar)
- usb: dwc3: pci: Sort out the Intel device IDs (Krogerus Heikki)
- usb: dwc3: pci: add support for the Intel Nova Lake -S (Krogerus Heikki)
- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792592] {CVE-2025-68331}
- usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762728] {CVE-2025-40345}
- USB: storage: Remove subclass and protocol overrides from Novatek quirk (Alan Stern)
- usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773676] {CVE-2018-1000204,CVE-2025-68288}
- usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea)
- usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai)
- usb: cdns3: Fix double resource release in cdns3_pci_probe (Miaoqian Lin)
- most: usb: fix double free on late probe failure (Johan Hovold)
- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin)
- mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). (Kuniyuki Iwashima)
- mptcp: clear scheduled subflows on retransmit (Paolo Abeni)
- mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level (Jisheng Zhang)
- mm/memfd: fix information leak in hugetlb folios (Deepanshu Kartikey) [Orabug: 38773697] {CVE-2025-68292}
- firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli)
- nvmem: layouts: fix nvmem_layout_bus_uevent (Guan Wentao)
- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin)
- thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski)
- smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773703] {CVE-2025-68295}
- drivers/usb/dwc3: fix PCI parent check (Jamie Iles)
- dm-verity: fix unreliable memory allocation (Mikulas Patocka)
- ceph: fix crash in process_v2_sparse_read() for encrypted directories (Viacheslav Dubeyko) [Orabug: 38773716] {CVE-2025-68297}
- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde)
- can: sja1000: fix max irq loop handling (Thomas Mühlbacher)
- Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref (Douglas Anderson) [Orabug: 38773723] {CVE-2025-68298}
- atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han)
- ARM: dts: nxp: imx6ul: correct SAI3 interrupt line (Maarten Zanders)
- arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity (Xu Yang)
- arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos (Frank Li)
- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (Ivan Zhaldak)
- tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (Deepanshu Kartikey) [Orabug: 38792583] {CVE-2025-68329}
- MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow (Thomas Bogendoerfer)
- MIPS: mm: Prevent a TLB shutdown on initial uniquification (Maciej W. Rozycki)
- iio: adc: rtq6056: Correct the sign bit index (Chiyuan Huang)
- iio: adc: ad7280a: fix ad7280_store_balance_timer() (David Lechner)
- iio: accel: fix ADXL355 startup race condition (Valek Andrej)
- iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792585] {CVE-2025-68330}
- iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling (Olivier Moysan)
- iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet)
- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra)
- iio: humditiy: hdc3020: fix units for thresholds and hysteresis (Dimitri Fedrau)
- iio: humditiy: hdc3020: fix units for temperature and humidity measurement (Dimitri Fedrau)
- iio: buffer: support getting dma channel from the buffer (Nuno Sa)
- iio: buffer-dmaengine: enable .get_dma_dev() (Nuno Sa)
- iio: buffer-dma: support getting the DMA channel (Nuno Sa)
- Revert "perf/x86: Always store regs-&gt;ip in perf_callchain_kernel()" (Jiri Olsa)
- Revert "drm/amd/display: Move setup_stream_attribute" (Alex Deucher)
- spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou)
- spi: nxp-fspi: Propagate fwnode in ACPI case as well (Andy Shevchenko)
- spi: spi-nxp-fspi: Add OCT-DTR mode support (Haibo Chen)
- spi: spi-nxp-fspi: remove the goto in probe (Haibo Chen)
- spi: nxp-fspi: Support per spi-mem operation frequency switches (Miquel Raynal)
- spi: spi-mem: Add a new controller capability (Miquel Raynal)
- spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency (Miquel Raynal)
- spi: spi-mem: Allow specifying the byte order in Octal DTR mode (Tudor Ambarus)
- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (Xu Wang)
- spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA (Francesco Lavra)
- fs/namespace: fix reference leak in grab_requested_mnt_ns (Andrei Vagin) [Orabug: 38773950] {CVE-2025-68300}
- mailbox: pcc: don't zero error register (Jamie Iles)
- mailbox: pcc: Refactor error handling in irq handler into separate function (Sudeep Holla)
- mailbox: mtk-cmdq: Refine DMA address handling for the command buffer (Jason-JH Lin)
- mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang)
- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (Xu Wang)
- iio: st_lsm6dsx: Fixed calibrated timestamp calculation (Mario Tesi)
- net: fec: do not register PPS event for PEROUT (Wei Fang)
- net: fec: do not allow enabling PPS and PEROUT simultaneously (Wei Fang)
- net: fec: do not update PEROUT if it is enabled (Wei Fang)
- net: fec: cancel perout_timer when PEROUT is disabled (Wei Fang)
- net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773728] {CVE-2025-68301}
- eth: fbnic: Fix counter roll-over issue (Mohsin Bashir)
- net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean)
- net: dsa: sja1105: simplify static configuration reload (Russell King)
- net: wwan: mhi: Keep modem name match with Foxconn T99W640 (Slark Xiao)
- drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (Alex Deucher)
- net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev)
- team: Move team device type change at the end of team_port_add (Nikola Z. Ivanov) [Orabug: 38796270] {CVE-2025-68340}
- net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino)
- drm/xe: Fix conversion from clock ticks to milliseconds (Harish Chegondi)
- net: lan966x: Fix the initialization of taprio (Horatiu Vultur)
- net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng)
- platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter)
- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (Daniel Golle)
- veth: reduce XDP no_direct return section to fix race (Jesper Dangaard Brouer) [Orabug: 38796276] {CVE-2025-68341}
- veth: more robust handing of race to avoid txq getting stuck (Jesper Dangaard Brouer)
- veth: prevent NULL pointer dereference in veth_xdp_rcv (Jesper Dangaard Brouer)
- veth: apply qdisc backpressure on full ptr_ring to reduce TX drops (Jesper Dangaard Brouer)
- net: sched: generalize check for no-queue qdisc on TX queue (Jesper Dangaard Brouer)
- Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz)
- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (Edward Adam Davis) [Orabug: 38773949] {CVE-2025-68305}
- Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP (Luiz Augusto von Dentz)
- Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface (Chris Lu) [Orabug: 38773748] {CVE-2025-68306}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data (Marc Kleine-Budde) [Orabug: 38796278] {CVE-2025-68342}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header (Marc Kleine-Budde) [Orabug: 38796285] {CVE-2025-68343}
- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (Marc Kleine-Budde) [Orabug: 38773751] {CVE-2025-68307}
- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [Orabug: 38773759] {CVE-2025-68308}
- LTS version: v6.12.60 (Jack Vogel)
- Revert "gpio: swnode: don't use the swnode's name as the key for GPIO lookup" (Charles Keepax)
- drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched (Fangzhi Zuo)
- drm/amd/display: Insert dccg log for easy debug (Charlene Liu)
- drm/amd/display: disable DPP RCG before DPP CLK enable (Charlene Liu)
- drm/amd/display: avoid reset DTBCLK at clock init (Charlene Liu)
- xfs: fix out of bounds memory read error in symlink repair (Darrick J. Wong) [Orabug: 38730602] {CVE-2025-40246}
- xfs: Replace strncpy with memcpy (Marcelo Moreira)
- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730655] {CVE-2025-40257}
- drm/i915/dp_mst: Disable Panel Replay (Imre Deak)
- maple_tree: fix tracepoint string pointers (Martin Kaiser)
- tty/vt: fix up incorrect backport to stable releases (Jari Ruusu)
- smb: client: fix incomplete backport in cfids_invalidation_worker() (Henrique Carvalho)
- drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (Samuel Zhang) [Orabug: 38773445] {CVE-2025-68230}
- tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun)
- net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
- ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe)
- s390/mm: Fix __ptep_rdp() inline assembly (Heiko Carstens)
- drm/xe: Prevent BIT() overflow when handling invalid prefetch region (Shuicheng Lin)
- Revert "RDMA/irdma: Update Kconfig" (Guan Wentao)
- KVM: arm64: Make all 32bit ID registers fully writable (Marc Zyngier)
- ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai)
- kconfig/nconf: Initialize the default locale at startup (Jakub Horký)
- kconfig/mconf: Initialize the default locale at startup (Jakub Horký)
- net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit)
- blk-crypto: use BLK_STS_INVAL for alignment errors (Carlos Llamas)
- net: tls: Change async resync helpers argument (Shahar Shitrit)
- selftests: net: use BASH for bareudp testing (Po-Hsu Lin)
- x86/microcode/AMD: Limit Entrysign signature checking to known generations (Borislav Petkov)
- scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773425] {CVE-2025-68224}
- cifs: fix typo in enable_gcm_256 module parameter (Steve French)
- bcma: don't register devices disabled in OF (Rafał Miłecki)
- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730610] {CVE-2025-40248}
- cifs: fix memory leak in smb3_fs_context_parse_param error path (Shaurya Rane) [Orabug: 38773403] {CVE-2025-68219}
- LoongArch: Use UAPI types in ptrace UAPI header (Thomas Weißschuh)
- af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic(). (Kuniyuki Iwashima)
- af_unix: Cache state-&gt;msg in unix_stream_read_generic(). (Kuniyuki Iwashima)
- devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (Shay Drory) [Orabug: 38730623] {CVE-2025-40251}
- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (Jared Kangas)
- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (Jared Kangas)
- ice: fix PTP cleanup on driver removal in error path (Grzegorz Nitka) [Orabug: 38773389] {CVE-2025-68215}
- idpf: fix possible vport_config NULL pointer deref in remove (Emil Tantilov) [Orabug: 38773956] {CVE-2025-68213}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730628] {CVE-2025-40252}
- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang)
- selftests: net: lib: Do not overwrite error messages (Ido Schimmel)
- s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
- nvme-multipath: fix lockdep WARN due to partition scan work (Shin'Ichiro Kawasaki) [Orabug: 38773400] {CVE-2025-68218}
- tools: riscv: Fixed misalignment of CSR related definitions (Chen Pei)
- net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730647] {CVE-2025-40254}
- net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() (Pavel Zhigulin)
- net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin)
- drm/tegra: Add call to put_pid() (Prateek Agarwal) [Orabug: 38773463] {CVE-2025-68233}
- mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
- platform/x86: msi-wmi-platform: Fix typo in WMI GUID (Armin Wolf)
- platform/x86: msi-wmi-platform: Only load on MSI devices (Armin Wolf)
- pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() (Xu Wang)
- xfrm: Prevent locally generated packets from direct output in tunnel mode (Jianbo Liu)
- xfrm: Determine inner GSO type from packet inner protocol (Jianbo Liu)
- pinctrl: realtek: Select REGMAP_MMIO for RTD driver (Yu-Chun Lin)
- xfrm: set err and extack on failure to create pcpu SA (Sabrina Dubroca)
- xfrm: drop SA reference in xfrm_state_update if dir doesn't match (Sabrina Dubroca)
- drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 (Ivan Lipski)
- drm/amd/display: Fix pbn to kbps Conversion (Fangzhi Zuo)
- drm/amd/display: Move sleep into each retry for retrieve_link_cap() (Mario Limonciello)
- drm/amd/display: Increase DPCD read retries (Mario Limonciello)
- drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (Yifan Zha)
- drm/amd: Skip power ungate during suspend for VPE (Mario Limonciello)
- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (Robert Mcclinton) [Orabug: 38773418] {CVE-2025-68223}
- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke)
- mptcp: do not fallback when OoO is present (Paolo Abeni)
- mptcp: decouple mptcp fastclose from tcp close (Paolo Abeni)
- mptcp: avoid unneeded subflow-level drops (Paolo Abeni)
- selftests: mptcp: join: userspace: longer timeout (Matthieu Baerts)
- selftests: mptcp: join: endpoints: longer timeout (Matthieu Baerts)
- mptcp: fix premature close in case of fallback (Paolo Abeni)
- mptcp: fix duplicate reset on fastclose (Paolo Abeni)
- mptcp: fix ack generation for fallback msk (Paolo Abeni)
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730658] {CVE-2025-40258}
- LoongArch: Don't panic if no valid cache info for PCI (Huacai Chen)
- dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski)
- MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
- scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773439] {CVE-2025-68229}
- scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730661] {CVE-2025-40259}
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730672] {CVE-2025-40261}
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne)
- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (Nam Cao) [Orabug: 38773467] {CVE-2025-68235}
- mm/mempool: fix poisoning order&gt;0 pages with HIGHMEM (Vlastimil Babka) [Orabug: 38773453] {CVE-2025-68231}
- Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
- Input: imx_sc_key - fix memory corruption on unload (Dan Carpenter)
- Input: goodix - add support for ACPI ID GDIX1003 (Hans de Goede)
- Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730679] {CVE-2025-40263}
- Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" (Diogo Ivo)
- net: dsa: microchip: lan937x: Fix RGMII delay tuning (Oleksij Rempel)
- be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730688] {CVE-2025-40264}
- ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() (Yihang Li)
- smb: client: introduce close_cached_dir_locked() (Henrique Carvalho)
- ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
- mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773434] {CVE-2025-68227}
- mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen)
- exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang)
- shmem: fix tmpfs reconfiguration (remount) when noswap is set (Mike Yuan)
- isofs: check the return value of sb_min_blocksize() in isofs_fill_super (Yongpeng Yang)
- mtdchar: fix integer overflow in read/write ioctls (Dan Carpenter) [Orabug: 38773476] {CVE-2025-68237}
- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara)
- arm64: dts: rockchip: disable HS400 on RK3588 Tiger (Quentin Schulz)
- arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1 (Quentin Schulz)
- arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5 (Mykola Kvach)
- arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2 (Diederik de Haas)
- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
- HID: amd_sfh: Stop sensor before starting (Mario Limonciello)
- timers: Fix NULL function pointer race in timer_shutdown_sync() (Yipeng Zou) [Orabug: 38773387] {CVE-2025-68214}
- KVM: arm64: Check the untrusted offset in FF-A memory share (Sebastian Ene) [Orabug: 38730696] {CVE-2025-40266}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.2.el10uek]" date="1766491200">- LTS version: v6.12.63 (Jack Vogel)
- ASoC: codecs: nau8325: Silence uninitialized variables warnings (Krzysztof Kozlowski)
- ALSA: wavefront: Fix integer overflow in sample size validation (Junrui Luo)
- ALSA: dice: fix buffer overflow in detect_stream_formats() (Junrui Luo)
- usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required (Sven Peter)
- usb: phy: Initialize struct usb_phy list_head (Diogo Ivo)
- usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (Haotien Hsu)
- tcp_metrics: use dst_dev_net_rcu() (Eric Dumazet) [Orabug: 38592188] {CVE-2025-40075}
- net: dst: introduce dst-&gt;dev_rcu (Eric Dumazet)
- net: lan743x: Allocate rings outside ZONE_DMA (Thangaraj Samynathan)
- LoongArch: Add machine_kexec_mask_interrupts() implementation (Huacai Chen)
- ocfs2: fix memory leak in ocfs2_merge_rec_left() (Dmitry Antipov)
- irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (Dan Carpenter)
- scsi: imm: Fix use-after-free bug caused by unfinished delayed work (Duoming Zhou) [Orabug: 38783113] {CVE-2025-68324}
- efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs (Mauro Carvalho Chehab)
- efi/cper: Adjust infopfx size to accept an extra space (Mauro Carvalho Chehab)
- efi/cper: Add a new helper function to print bitmasks (Mauro Carvalho Chehab)
- dm log-writes: Add missing set_freezable() for freezable kthread (Xu Wang)
- dm-raid: fix possible NULL dereference with undefined raid type (Alexey Simakov)
- block: return unsigned int from queue_dma_alignment (Christoph Hellwig)
- block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set-&gt;tag_list_lock (Mohamed Khalfella) [Orabug: 38818209] {CVE-2025-68756}
- ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() (Pangliyuan)
- ALSA: firewire-motu: add bounds check in put_user loop for DSP events (Junrui Luo)
- rtc: gamecube: Check the return value of ioremap() (Xu Wang)
- drm/amdkfd: Use huge page size to check split svm range alignment (Xiaogang Chen)
- ALSA: uapi: Fix typo in asound.h comment (Andres J Rosa)
- docs: hwmon: fix link to g762 devicetree binding (Kathara Sasikumar)
- cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 (David Howells)
- drm/nouveau: refactor deprecated strcpy (Madhur Kumar)
- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (Junrui Luo)
- regulator: fixed: Rely on the core freeing the enable GPIO (Mark Brown)
- drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() (Dan Carpenter)
- nvme-auth: use kvfree() for memory allocated with kvcalloc() (Israel Rukshin)
- block: fix memory leak in __blkdev_issue_zero_pages (Shaurya Rane) [Orabug: 38798772] {CVE-2025-68348}
- block: fix comment for op_is_zone_mgmt() to include RESET_ALL (Shechenglong)
- blk-mq: Abort suspend when wakeup events are pending (Cong Zhang)
- ASoC: ak5558: Disable regulator when error happens (Shengjiu Wang)
- ASoC: ak4458: Disable regulator when error happens (Shengjiu Wang)
- ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (Xu Wang)
- platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (Anton Khirnov)
- fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() (Armin Wolf)
- NFS: Fix inheritance of the block sizes when automounting (Trond Myklebust)
- Expand the type of nfs_fattr-&gt;valid (Trond Myklebust)
- NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (Trond Myklebust) [Orabug: 38818236] {CVE-2025-68764}
- Revert "nfs: ignore SB_RDONLY when mounting nfs" (Trond Myklebust)
- Revert "nfs: clear SB_RDONLY before getting superblock" (Trond Myklebust)
- Revert "nfs: ignore SB_RDONLY when remounting nfs" (Trond Myklebust)
- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (Jonathan Curley) [Orabug: 38798774] {CVE-2025-68349}
- NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state (Trond Myklebust)
- nfs/vfs: discard d_exact_alias() (Neil Brown)
- NFS: Initialise verifiers for visible dentries in nfs_atomic_open() (Trond Myklebust)
- NFS: Initialise verifiers for visible dentries in readdir and lookup (Trond Myklebust)
- fs/nls: Fix utf16 to utf8 conversion (Armin Wolf)
- NFS: Avoid changing nlink when file removes and attribute updates race (Trond Myklebust)
- f2fs: maintain one time GC mode is enabled during whole zoned GC cycle (Daeho Jeong)
- f2fs: add gc_boost_gc_greedy sysfs node (Daeho Jeong)
- f2fs: add gc_boost_gc_multiple sysfs node (Daeho Jeong)
- f2fs: introduce reserved_pin_section sysfs entry (Chao Yu)
- f2fs: sysfs: add encoding_flags entry (Chao Yu)
- f2fs: add carve_out sysfs node (Daeho Jeong)
- f2fs: fix to avoid running out of free segments (Chao Yu)
- f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages (Jaegeuk Kim)
- f2fs: keep POSIX_FADV_NOREUSE ranges (Jaegeuk Kim)
- platform/x86:intel/pmc: Update Arrow Lake telemetry GUID (Xi Pardee)
- sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out (Xupengbo)
- 9p: fix cache/debug options printing in v9fs_show_options (Eric Sandeen)
- fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (Abdun Nihaal)
- pinctrl: single: Fix incorrect type for error return variable (Xu Wang)
- perf hist: In init, ensure mem_info is put on error paths (Ian Rogers)
- perf tools: Fix split kallsyms DSO counting (Namhyung Kim)
- perf tools: Mark split kallsyms DSOs as loaded (Namhyung Kim)
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei) [Orabug: 38783136] {CVE-2025-68325}
- net: dsa: xrs700x: reject unsupported HSR configurations (Vladimir Oltean)
- net: hsr: create an API to get hsr port type (Xiaoliang Yang)
- net: hsr: Create and export hsr_get_port_ndev() (Md Danish Anwar)
- net: hsr: remove synchronize_rcu() from hsr_add_port() (Eric Dumazet)
- net: hsr: remove one synchronize_rcu() from hsr_del_port() (Eric Dumazet)
- clk: keystone: fix compile testing (Johan Hovold)
- md/raid5: fix IO hang when array is broken with IO inflight (Yu Kuai)
- remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs (Alexandru Gagniuc)
- mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (Ivan Stepchenko)
- selftests: bonding: add delay before each xvlan_over_bond connectivity check (Hangbin Liu)
- selftests: bonding: add ipvlan over bond testing (Etienne Champetier)
- net: phy: aquantia: check for NVMEM deferral (Robert Marko)
- vfio/pci: Use RCU for error/request triggers to avoid circular locking (Alex Williamson)
- spi: ch341: fix out-of-bounds memory access in ch341_transfer_one (Tianchu Chen)
- mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (Xu Wang)
- net: stmmac: fix rx limit check in stmmac_rx_zc() (Alexey Kodanev)
- netfilter: nft_connlimit: update the count if add was skipped (Fernando Fernandez Mancera)
- netfilter: nf_conncount: rework API to use sk_buff directly (Fernando Fernandez Mancera)
- netfilter: flowtable: check for maximum number of encapsulations in bridge vlan (Pablo Neira Ayuso)
- Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" (Ilias Stamatis)
- resource: introduce is_type_match() helper and use it (Andy Shevchenko)
- resource: replace open coded resource_intersection() (Andy Shevchenko)
- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (Sparkhuang) [Orabug: 38798786] {CVE-2025-68354}
- ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND (Mikhail Kshevetskiy)
- ASoC: Intel: catpt: Fix error path in hw_params() (Cezary Rojewski)
- vdpa/pds: use %pe for ERR_PTR() in event handler registration (Alok Tiwari)
- vhost: Fix kthread worker cgroup failure handling (Mike Christie)
- vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues (Alok Tiwari)
- virtio: fix virtqueue_set_affinity() docs (Michael S. Tsirkin)
- virtio: fix grammar in virtio_queue_info docs (Michael S. Tsirkin)
- virtio: fix whitespace in virtio_config_ops (Michael S. Tsirkin)
- virtio: fix typo in virtio_device_ready() comment (Michael S. Tsirkin)
- virtio_vdpa: fix misleading return in void function (Alok Tiwari)
- of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node (Guenter Roeck)
- ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation (Yongjian Sun)
- ublk: prevent invalid access with DEBUG (Kevin Brodsky)
- ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (René Rebe)
- hwmon: sy7636a: Fix regulator_enable resource leak on error path (Xu Wang)
- drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (Dan Carpenter)
- greybus: gb-beagleplay: Fix timeout handling in bootloader functions (Xu Wang)
- firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER (Alexandre Courbot)
- ASoC: fsl_xcvr: clear the channel status control memory (Shengjiu Wang)
- gfs2: Prevent recursive memory reclaim (Andreas Gruenbacher) [Orabug: 38798793] {CVE-2025-68356}
- ASoC: nau8325: add missing build config (Jaroslav Kysela)
- ASoC: nau8325: use simple i2c probe function (Jaroslav Kysela)
- drm/panthor: Avoid adding of kernel BOs to extobj list (Akash Goel)
- RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY (Jacob Moroni)
- RDMA/irdma: Fix data race in irdma_free_pble (Krzysztof Czurylo)
- RDMA/irdma: Fix data race in irdma_sc_ccq_arm (Krzysztof Czurylo)
- iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal (Stephan Gerhold)
- backlight: lp855x: Fix lp855x.h kernel-doc warnings (Randy Dunlap)
- backlight: led-bl: Add devlink to supplier LEDs (Luca Ceresoli)
- wifi: ieee80211: correct FILS status codes (Ria Thomas)
- iomap: always run error completions in user context (Christoph Hellwig)
- iomap: factor out a iomap_dio_done helper (Christoph Hellwig)
- um: Don't rename vmap to kernel_vmap (David Gow)
- drm/nouveau: restrict the flush page to a 32-bit address (Timur Tabi)
- PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (Shawn Lin)
- btrfs: fix leaf leak in an error path in btrfs_del_items() (Filipe Manana)
- iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables (Ryan Huang)
- staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (Jianglei Nie)
- firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (Dinh Nguyen)
- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (Zilin Guan)
- ASoC: tas2781: correct the wrong period (Shenghao Ding)
- RDMA/bnxt_re: Pass correct flag for dma mr creation (Selvin Xavier)
- RDMA/bnxt_re: Fix the inline size for GenP7 devices (Selvin Xavier)
- erofs: limit the level of fs stacking for file-backed mounts (Gao Xiang)
- RISC-V: KVM: Fix guest page fault within HLV* instructions (Fangyu Yu)
- crypto: ccree - Correctly handle return of sg_nents_for_len (Xu Wang)
- crypto: starfive - Correctly handle return of sg_nents_for_len (Xu Wang)
- selftests/bpf: Improve reliability of test_perf_branches_no_hw() (Matt Bobrowski)
- selftests/bpf: skip test_perf_branches_hw() on unsupported platforms (Matt Bobrowski)
- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon)
- usb: dwc2: fix hang during suspend if set as peripheral (Jisheng Zhang)
- usb: dwc2: fix hang during shutdown if set as peripheral (Jisheng Zhang)
- usb: dwc2: disable platform lowlevel hw resources during shutdown (Jisheng Zhang)
- usb: chaoskey: fix locking for O_NONBLOCK (Oliver Neukum)
- ima: Handle error code returned by ima_filter_rule_match() (Zhao Yipeng) [Orabug: 38798921] {CVE-2025-68740}
- RAS: Report all ARM processor CPER information to userspace (Jason Tian)
- wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (Seungjin Bae) [Orabug: 38798814] {CVE-2025-68362}
- cpuset: Treat cpusets in attaching as populated (Chen Ridong)
- net: phy: adin1100: Fix software power-down ready condition (Alexander Dahl)
- phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth (Cristian Ciocaltea)
- phy: freescale: Initialize priv-&gt;lock (Xiaolei Wang)
- phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (Christophe Jaillet)
- leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM (Fenglin Wu)
- mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- wifi: mac80211: fix CMAC functions not handling errors (Chien Wong)
- iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb (Aashish Sharma)
- scsi: qla2xxx: Fix improper freeing of purex item (Zilin Guan) [Orabug: 38798928] {CVE-2025-68741}
- pwm: bcm2835: Make sure the channel is enabled after pwm_request() (Uwe Kleine-König)
- perf arm_spe: Fix memset subclass in operation (Leo Yan)
- perf arm-spe: Extend branch operations (Leo Yan)
- ipv6: clear RA flags when adding a static route (Fernando Fernandez Mancera)
- drm/msm/a6xx: Improve MX rail fallback in RPMH vote init (Akhil P Oommen)
- drm/msm/a6xx: Fix the gemnoc workaround (Akhil P Oommen)
- drm/msm/a6xx: Flush LRZ cache before PT switch (Akhil P Oommen)
- drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (Jay Liu)
- fs/ntfs3: Prevent memory leaks in add sub record (Edward Adam Davis)
- fs/ntfs3: out1 also needs to put mi (Edward Adam Davis)
- powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format (Ritesh Harjani)
- powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit (Ritesh Harjani)
- bpf: Fix invalid prog-&gt;stats access when update_effective_progs fails (Pu Lehui) [Orabug: 38798931] {CVE-2025-68742}
- wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (Abdun Nihaal) [Orabug: 38818221] {CVE-2025-68759}
- drm/msm/a2xx: stop over-complaining about the legacy firmware (Dmitry Baryshkov)
- block/blk-throttle: Fix throttle slice time for SSDs (Guenter Roeck)
- NFSD/blocklayout: Fix minlength check in proc_layoutget (Sergey Bashirov)
- tracefs: fix a leak in eventfs_create_events_dir() (Al Viro)
- watchdog: starfive: Fix resource leak in probe error path (Xu Wang)
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (Xu Wang)
- bpf: Check skb-&gt;transport_header is set in bpf_skb_check_mtu (Martin Kafai Lau) [Orabug: 38798820] {CVE-2025-68363}
- selftests/bpf: Fix failure paths in send_signal test (Alexei Starovoitov)
- bpf: Handle return value of ftrace_set_filter_ip in register_fentry (Menglong Dong)
- ps3disk: use memcpy_{from,to}_bvec index (René Rebe)
- drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype (Dmitry Baryshkov)
- crypto: iaa - Fix incorrect return value in save_iaa_wq() (Zilin Guan)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C (Fukaumi Naoki)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A (Fukaumi Naoki)
- arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A (Fukaumi Naoki)
- PCI: keystone: Exit ks_pcie_probe() for invalid mode (Siddharth Vadapalli)
- bpf: Free special fields when update [lru_,]percpu_hash maps (Leon Hwang) [Orabug: 38798936] {CVE-2025-68744}
- leds: netxbig: Fix GPIO descriptor leak in error paths (Xu Wang)
- scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls (Xu Wang)
- ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (Xu Wang)
- ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() (Dmitry Antipov) [Orabug: 38798823] {CVE-2025-68364}
- lib/vsprintf: Check pointer before dereferencing in time_and_date() (Andy Shevchenko)
- clk: renesas: r9a06g032: Fix memory leak in error path (Xu Wang)
- coresight: etm4x: Add context synchronization before enabling trace (Leo Yan)
- coresight: etm4x: Extract the trace unit controlling (Leo Yan)
- coresight: etm4x: Correct polling IDLE bit (Leo Yan)
- coresight: Change device mode to atomic type (Leo Yan)
- nbd: defer config unlock in nbd_genl_connect (Zheng Qixing) [Orabug: 38798832] {CVE-2025-68366}
- wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (Abdun Nihaal)
- macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (Long Li) [Orabug: 38798837] {CVE-2025-68367}
- powerpc/32: Fix unpaired stwcx. on interrupt exit (Christophe Leroy)
- powerpc/kdump: Fix size calculation for hot-removed memory ranges (Sourabh Jain)
- cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs (Gautham R. Shenoy)
- scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() (Bean Huo)
- drm/panthor: Fix potential memleak of vma structure (Akash Goel)
- ntfs3: init run lock for extend inode (Edward Adam Davis)
- ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties (Jihed Chaibi)
- RDMA/rtrs: server: Fix error handling in get_or_create_srv (Ma Ke)
- dt-bindings: PCI: amlogic: Fix the register name of the DBI region (Manivannan Sadhasivam)
- scsi: smartpqi: Fix device resources accessed after device removal (Mike Mcgowen) [Orabug: 38798847] {CVE-2025-68371}
- scsi: stex: Fix reboot_notifier leak in probe error path (Xu Wang)
- nbd: defer config put in recv_work (Zheng Qixing) [Orabug: 38798850] {CVE-2025-68372}
- md: fix rcu protection in md_wakeup_thread (Yun Zhou) [Orabug: 38798857] {CVE-2025-68374}
- regulator: core: disable supply if enabling main regulator fails (Gabor Juhos)
- perf/x86/intel: Correct large PEBS flag check (Dapeng Mi)
- ext4: correct the checking of quota files before moving extents (Zhang Yi)
- mfd: da9055: Fix missing regmap_del_irq_chip() in error path (Xu Wang)
- locktorture: Fix memory leak in param_set_cpumask() (Wang Liang)
- efi/libstub: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- x86/boot: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels (Yegor Yefremov)
- libbpf: Fix parsing of multi-split BTF (Alan Maguire)
- spi: tegra210-quad: Fix timeout handling (Vishwaroop A) [Orabug: 38798943] {CVE-2025-68746}
- drm/panthor: Fix UAF on kernel BO VA nodes (Boris Brezillon)
- drm/panthor: Fix race with suspend during unplug (Ketil Johnsen)
- drm/panthor: Fix UAF race between device unplug and FW event processing (Ketil Johnsen)
- drm/panthor: Fix group_free_queue() for partially initialized queues (Boris Brezillon)
- drm/panthor: Handle errors returned by drm_sched_entity_init() (Boris Brezillon)
- fs/9p: Don't open remote file with APPEND mode when writeback cache is used (Tingmao Wang)
- scsi: target: Do not write NUL characters into ASCII configfs output (Bart Van Assche)
- power: supply: apm_power: only unset own apm_get_power_status (Ahelenia Ziemiańska)
- power: supply: wm831x: Check wm831x_set_bits() return value (Ivan Abramov)
- power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (Murad Masimov)
- power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (Ivan Abramov)
- power: supply: max17040: Check iio_read_channel_processed() return code (Ivan Abramov)
- power: supply: cw2015: Check devm_delayed_work_autocancel() return code (Ivan Abramov)
- power: supply: rt5033_charger: Fix device node reference leaks (Xu Wang)
- perf record: skip synthesize event when open evsel failed (Shuai Xue)
- perf lock contention: Load kernel map before lookup (Namhyung Kim)
- drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() (Geert Uytterhoeven)
- interconnect: debugfs: Fix incorrect error handling for NULL path (Kuan-Wei Chiu)
- arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller (Dmitry Baryshkov)
- interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS (Dmitry Baryshkov)
- wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() (Abdun Nihaal)
- i3c: master: svc: Prevent incomplete IBI transaction (Stanley Chu)
- i3c: fix refcount inconsistency in i3c_master_register (Frank Li)
- pinctrl: stm32: fix hwspinlock resource leak in probe function (Xu Wang)
- soc: qcom: smem: fix hwspinlock resource leak in probe error paths (Xu Wang)
- tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set (Benjamin Berg)
- x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() (Tengda Wu)
- task_work: Fix NMI race condition (Peter Zijlstra)
- perf/x86/intel/cstate: Remove PC3 support from LunarLake (Zhang Rui)
- bpf: Fix stackmap overflow check in __bpf_get_stackid() (Arnaud Lecomte) [Orabug: 38798864] {CVE-2025-68378}
- bpf: Refactor stack map trace depth calculation into helper function (Arnaud Lecomte)
- perf: Remove get_perf_callchain() init_nr argument (Josh Poimboeuf)
- mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (Xu Wang)
- mtd: nand: relax ECC parameter validation check (Aryan Srivastava)
- Revert "mtd: rawnand: marvell: fix layouts" (Aryan Srivastava)
- ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties (Wolfram Sang)
- ARM: dts: renesas: gose: Remove superfluous port property (Wolfram Sang)
- RDMA/rxe: Fix null deref on srq-&gt;rq.queue after resize failure (Zhu Yanjun) [Orabug: 38798867] {CVE-2025-68379}
- sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Kuniyuki Iwashima)
- phy: mscc: Fix PTP for VSC8574 and VSC8572 (Horatiu Vultur)
- arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory (Alexander Martinz)
- arm64: dts: qcom: sm8650: set ufs as dma coherent (Neil Armstrong)
- arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider (Gergo Koteles)
- arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller (Krishna Kurapati)
- arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller (Krishna Kurapati)
- firmware: imx: scu-irq: fix OF node leak in (Peng Fan)
- arm64: dts: ti: k3-am62p: Fix memory ranges for GPU (Randolph Sapp)
- s390/ap: Don't leak debug feature files if AP instructions are not available (Heiko Carstens)
- s390/smp: Fix fallback CPU detection (Heiko Carstens)
- wifi: ath11k: fix peer HE MCS assignment (Baochen Qiang) [Orabug: 38798872] {CVE-2025-68380}
- wifi: ath11k: fix VHT MCS assignment (Baochen Qiang)
- crypto: hisilicon/qm - restore original qos values (Nieweiqiang)
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (Thorsten Blum) [Orabug: 38798874] {CVE-2025-68724}
- soc: qcom: gsbi: fix double disable caused by devm (Xu Wang)
- soc: Switch back to struct platform_driver::remove() (Uwe Kleine-König)
- clk: qcom: camcc-sm7150: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (Li Qiang)
- PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (Geert Uytterhoeven)
- arm64: dts: exynos: gs101: fix sysreg_apm reg property (Peter Griffin)
- perf annotate: Check return value of evsel__get_arch() properly (Tianyou Li)
- arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 (Tim Harvey)
- arm64: dts: imx8mp-venice-gw702x: remove off-board uart (Tim Harvey)
- arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl (Tim Harvey)
- arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props (Tim Harvey)
- block/mq-deadline: Switch back to a single dispatch list (Bart Van Assche)
- block/mq-deadline: Introduce dd_start_request() (Bart Van Assche)
- firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc (Randy Dunlap)
- iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (Francesco Lavra)
- inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() (Luoxuanqiang)
- inet: Avoid ehash lookup race in inet_ehash_insert() (Luoxuanqiang)
- rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() (Luoxuanqiang)
- clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets (Stephan Gerhold)
- ntfs3: Fix uninit buffer allocated by __getname() (Sidharth Seela)
- ntfs3: fix uninit memory after failed mi_read in mi_format_new (Raphael Pinsonneault-Thibeault)
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Herbert Xu)
- irqchip/qcom-irq-combiner: Fix section mismatch (Johan Hovold)
- irqchip/starfive-jh8100: Fix section mismatch (Johan Hovold)
- irqchip/renesas-rzg2l: Fix section mismatch (Johan Hovold)
- irqchip/imx-mu-msi: Fix section mismatch (Johan Hovold)
- irqchip/irq-brcmstb-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7120-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7038-l1: Fix section mismatch (Johan Hovold)
- sched/fair: Forfeit vruntime on yield (Fernand Sieber)
- wifi: ath11k: restore register window after global reset (Baochen Qiang)
- wifi: ath10k: move recovery check logic into a new work (Kang Yang)
- wifi: ath10k: Add missing include of export.h (Jeff Johnson)
- wifi: ath10k: Avoid vdev delete timeout when firmware is already down (Loic Poulain)
- objtool: Fix weak symbol detection (Josh Poimboeuf)
- objtool: Fix standalone --hacks=jump_label (Dylan Hatch)
- HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (Mavroudis Chatzilazaridis)
- drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() (Cyrille Pitchen)
- clk: renesas: cpg-mssr: Read back reset registers to assure values latched (Marek Vasut)
- clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register (Thierry Bultel)
- clk: renesas: Use str_on_off() helper (Geert Uytterhoeven)
- clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (Marek Vasut)
- pinctrl: renesas: rzg2l: Fix PMC restore (Biju Das)
- USB: Fix descriptor count when handling invalid MBIM extended descriptor (Seungjin Bae)
- drm/vgem-fence: Fix potential deadlock on release (Janusz Krzysztofik) [Orabug: 38818211] {CVE-2025-68757}
- accel/ivpu: Fix DCT active percent format (Karol Wachowski)
- accel/ivpu: Make function parameter names consistent (Jacek Lawrynowicz)
- drm/panel: visionox-rm69299: Don't clear all mode flags (Guido Günther)
- accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail (Karol Wachowski)
- accel/ivpu: Prevent runtime suspend during context abort work (Andrzej Kacprowski)
- gpu: host1x: Fix race in syncpt alloc/free (Mainak Sen) [Orabug: 38798898] {CVE-2025-68732}
- smack: fix bug: setting task label silently ignores input garbage (Konstantin Andreev)
- smack: fix bug: unprivileged task can create labels (Konstantin Andreev)
- smack: fix bug: invalid label of unix socket file (Konstantin Andreev)
- smack: always "instantiate" inode in smack_inode_init_security() (Konstantin Andreev)
- smack: deduplicate xattr setting in smack_inode_init_security() (Konstantin Andreev)
- smack: fix bug: SMACK64TRANSMUTE set on non-directory (Konstantin Andreev)
- smack: deduplicate "does access rule request transmutation" (Konstantin Andreev)
- net/mlx5e: Set default burst period for TX and RX reporters (Shahar Shitrit) [Orabug: 38636804]
- devlink: Make health reporter burst period configurable (Shahar Shitrit) [Orabug: 38636804]
- devlink: Introduce burst period for health reporter (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move health reporter recovery abort logic to a separate function (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move graceful period parameter to reporter ops (Shahar Shitrit) [Orabug: 38636804]
- devlink: use devlink_nl_put_u64() helper (Przemek Kitszel) [Orabug: 38636804]
- devlink: introduce devlink_nl_put_u64() (Przemek Kitszel) [Orabug: 38636804]
- Revert "net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery" (Qing Huang) [Orabug: 38636804]
- net/rds: improve conn destroy printk message (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: expand kref coverage to rds_notifier-&gt;n_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: rds_sendmsg must use rs_conn only when not being destroyed (Sharath Srinivasan) [Orabug: 38728742]
- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang) [Orabug: 38766139]
- mm: list_lru: avoid using NULL list_lru_one. (Imran Khan) [Orabug: 38787957]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg)
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa)
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn)
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe)
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping)
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen)
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan)
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo) [Orabug: 38847806] {CVE-2025-68789}
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera)
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38649136]  {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.1.el10uek]" date="1769688000">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang)  [Orabug: 38899652]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.2.el10uek]" date="1770897600">- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan)  [Orabug: 38937451]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.3.el10uek]" date="1771329600">- net/rds: Fix issue with a revert in rds_send_queue_rm (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
</package>
<package pkgid="14997f59a476b72632bd818244e398510ae94db5" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="108.64.6.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge) [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp) [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal) [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.62.1.el10uek]" date="1765886400">- uek-rpm: Allow disabling kabichk at command line (Yifei Liu) [Orabug: 38733049]
- Revert "xfrm: Use xdo.dev instead of xdo.real_dev" (Jack Vogel) [Orabug: 38718730]
- Revert "net/mlx5: Fix IPsec cleanup over MPV device" (Jack Vogel) [Orabug: 38718730]
- LTS version: v6.12.62 (Jack Vogel)
- bus: mhi: host: pci_generic: Add Telit FN990B40 modem support (Daniele Palmas)
- bus: mhi: host: pci_generic: Add Telit FN920C04 modem support (Daniele Palmas)
- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (Navaneeth K)
- staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (Navaneeth K)
- staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (Navaneeth K)
- comedi: check device's attached status in compat ioctls (Nikita Zhandarovich)
- comedi: multiq3: sanitize config options in multiq3_attach() (Nikita Zhandarovich)
- comedi: c6xdigio: Fix invalid PNP driver unregistration (Ian Abbott)
- wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (Zenm Chen)
- wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1 (Zenm Chen)
- samples: work around glibc redefining some of our defines wrong (Linus Torvalds)
- LoongArch: Mask all interrupts during kexec/kdump (Huacai Chen)
- HID: elecom: Add support for ELECOM M-XT3URBK (018F) (Naoki Ueki)
- platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (Antheas Kapenekakis)
- platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (Antheas Kapenekakis)
- platform/x86: huawei-wmi: add keys for HONOR models (Ston Jia)
- HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (April Grimoire)
- platform/x86: acer-wmi: Ignore backlight event (Armin Wolf)
- pinctrl: qcom: msm: Fix deadlock in pinmux configuration (Praveen Talari)
- nvme: fix admin request_queue lifetime (Keith Busch) [Orabug: 38773611] {CVE-2025-68265}
- HID: hid-input: Extend Elan ignore battery quirk to USB (Mario Limonciello)
- bfs: Reconstruct file type when loading from disk (Tetsuo Handa)
- ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (Lushih Hsieh)
- drm/amdkfd: Fix GPU mappings for APU after prefetch (Harish Kasiviswanathan)
- smb: fix invalid username check in smb3_fs_context_parse_param() (Yiqi Sun)
- Bluetooth: btrtl: Avoid loading the config file on security chips (Max Chou)
- drm/vmwgfx: Use kref in vmw_bo_dirty (Ian Forbes)
- spi: imx: keep dma request disabled before dma transfer setup (Robin Gong)
- spi: xilinx: increase number of retries before declaring stall (Alvaro Gamez Machado)
- ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() (Song Liu)
- USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- serial: add support of CPCI cards (Magne Bruno)
- USB: serial: ftdi_sio: match on interface number for jtag (Johan Hovold)
- USB: serial: option: move Telit 0x10c7 composition in the right place (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FE910C04 new compositions (Fabio Porcedda)
- USB: serial: option: add Foxconn T99W760 (Slark Xiao)
- KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (Omar Sandoval) [Orabug: 38773578] {CVE-2025-68259}
- comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (Nikita Zhandarovich)
- ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (Alexey Nepomnyashih) [Orabug: 38773586] {CVE-2025-68261}
- locking/spinlock/debug: Fix data-race in do_raw_write_lock (Alexander Sverdlin)
- ksmbd: ipc: fix use-after-free in ipc_msg_send_request (Qianchang Zhao)
- ext4: refresh inline data size before write operations (Deepanshu Kartikey) [Orabug: 38773602] {CVE-2025-68264}
- jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (Ye Bin) [Orabug: 38792632] {CVE-2025-68337}
- Documentation: process: Also mention Sasha Levin as stable tree maintainer (Bagas Sanjaya)
- xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca)
- xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)
- Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca)
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca) [Orabug: 38730491,38854317] {CVE-2025-40215}
- LTS version: v6.12.61 (Jack Vogel)
- spi: spi-nxp-fspi: Check return value of devm_mutex_init() (Thomas Weißschuh)
- drm/i915/dp: Initialize the source OUI write timestamp always (Imre Deak)
- Revert "ACPI: Suppress misleading SPCR console message when SPCR table is absent" (Punit Agrawal)
- wifi: ath12k: correctly handle mcast packets for clients (Sarika Sharma)
- net: dsa: microchip: Free previously initialized ports on init failures (Bastien Curutchet)
- net: dsa: microchip: Do not execute PTP driver code for unsupported switches (Tristram Ha)
- drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (Thomas Zimmermann) [Orabug: 38773709] {CVE-2025-68296}
- net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() (Bastien Curutchet)
- KVM: SVM: Fix redundant updates of LBR MSR intercepts (Yosry Ahmed)
- KVM: nSVM: Fix and simplify LBR virtualization handling with nested (Yosry Ahmed)
- KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() (Yosry Ahmed)
- KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts() (Yosry Ahmed)
- mm/huge_memory: fix NULL pointer deference when splitting folio (Wei Yang) [Orabug: 38773700] {CVE-2025-68293}
- usb: gadget: udc: fix use-after-free in usb_gadget_state_work (Jimmy Hu) [Orabug: 38773635] {CVE-2025-68282}
- usb: udc: Add trace event for usb_gadget_set_state (Kuen-Han Tsai)
- can: rcar_canfd: Fix CAN-FD mode as default (Biju Das)
- usb: typec: ucsi: psy: Set max current to zero when disconnected (Jameson Thies)
- nfsd: Replace clamp_t in nfsd4_get_drc_mem() (Neil Brown)
- staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann)
- libceph: replace BUG_ON with bounds check for map-&gt;max_osd (Ziming Zhang) [Orabug: 38773641] {CVE-2025-68283}
- libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773648] {CVE-2025-68284}
- libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773654] {CVE-2025-68285}
- net: dsa: microchip: Don't free uninitialized ksz_irq (Bastien Curutchet)
- net: dsa: microchip: ptp: Fix checks on irq_find_mapping() (Bastien Curutchet)
- net: dsa: microchip: common: Fix checks on irq_find_mapping() (Bastien Curutchet)
- drm/amd/display: Don't change brightness for disabled connectors (Mario Limonciello)
- drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773661] {CVE-2025-68286}
- drm/amd/amdgpu: reserve vm invalidation engine for uni_mes (Michael Chen)
- drm: sti: fix device leaks at component probe (Johan Hovold)
- USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang)
- USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov)
- xhci: dbgtty: fix device unregister (Łukasz Bartosik)
- xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman)
- xhci: fix stale flag preventig URBs after link state error is cleared (Mathias Nyman)
- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar)
- usb: dwc3: pci: Sort out the Intel device IDs (Krogerus Heikki)
- usb: dwc3: pci: add support for the Intel Nova Lake -S (Krogerus Heikki)
- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792592] {CVE-2025-68331}
- usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762728] {CVE-2025-40345}
- USB: storage: Remove subclass and protocol overrides from Novatek quirk (Alan Stern)
- usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773676] {CVE-2018-1000204,CVE-2025-68288}
- usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea)
- usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai)
- usb: cdns3: Fix double resource release in cdns3_pci_probe (Miaoqian Lin)
- most: usb: fix double free on late probe failure (Johan Hovold)
- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin)
- mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). (Kuniyuki Iwashima)
- mptcp: clear scheduled subflows on retransmit (Paolo Abeni)
- mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level (Jisheng Zhang)
- mm/memfd: fix information leak in hugetlb folios (Deepanshu Kartikey) [Orabug: 38773697] {CVE-2025-68292}
- firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli)
- nvmem: layouts: fix nvmem_layout_bus_uevent (Guan Wentao)
- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin)
- thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski)
- smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773703] {CVE-2025-68295}
- drivers/usb/dwc3: fix PCI parent check (Jamie Iles)
- dm-verity: fix unreliable memory allocation (Mikulas Patocka)
- ceph: fix crash in process_v2_sparse_read() for encrypted directories (Viacheslav Dubeyko) [Orabug: 38773716] {CVE-2025-68297}
- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde)
- can: sja1000: fix max irq loop handling (Thomas Mühlbacher)
- Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref (Douglas Anderson) [Orabug: 38773723] {CVE-2025-68298}
- atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han)
- ARM: dts: nxp: imx6ul: correct SAI3 interrupt line (Maarten Zanders)
- arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity (Xu Yang)
- arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos (Frank Li)
- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (Ivan Zhaldak)
- tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (Deepanshu Kartikey) [Orabug: 38792583] {CVE-2025-68329}
- MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow (Thomas Bogendoerfer)
- MIPS: mm: Prevent a TLB shutdown on initial uniquification (Maciej W. Rozycki)
- iio: adc: rtq6056: Correct the sign bit index (Chiyuan Huang)
- iio: adc: ad7280a: fix ad7280_store_balance_timer() (David Lechner)
- iio: accel: fix ADXL355 startup race condition (Valek Andrej)
- iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792585] {CVE-2025-68330}
- iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling (Olivier Moysan)
- iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet)
- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra)
- iio: humditiy: hdc3020: fix units for thresholds and hysteresis (Dimitri Fedrau)
- iio: humditiy: hdc3020: fix units for temperature and humidity measurement (Dimitri Fedrau)
- iio: buffer: support getting dma channel from the buffer (Nuno Sa)
- iio: buffer-dmaengine: enable .get_dma_dev() (Nuno Sa)
- iio: buffer-dma: support getting the DMA channel (Nuno Sa)
- Revert "perf/x86: Always store regs-&gt;ip in perf_callchain_kernel()" (Jiri Olsa)
- Revert "drm/amd/display: Move setup_stream_attribute" (Alex Deucher)
- spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou)
- spi: nxp-fspi: Propagate fwnode in ACPI case as well (Andy Shevchenko)
- spi: spi-nxp-fspi: Add OCT-DTR mode support (Haibo Chen)
- spi: spi-nxp-fspi: remove the goto in probe (Haibo Chen)
- spi: nxp-fspi: Support per spi-mem operation frequency switches (Miquel Raynal)
- spi: spi-mem: Add a new controller capability (Miquel Raynal)
- spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency (Miquel Raynal)
- spi: spi-mem: Allow specifying the byte order in Octal DTR mode (Tudor Ambarus)
- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (Xu Wang)
- spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA (Francesco Lavra)
- fs/namespace: fix reference leak in grab_requested_mnt_ns (Andrei Vagin) [Orabug: 38773950] {CVE-2025-68300}
- mailbox: pcc: don't zero error register (Jamie Iles)
- mailbox: pcc: Refactor error handling in irq handler into separate function (Sudeep Holla)
- mailbox: mtk-cmdq: Refine DMA address handling for the command buffer (Jason-JH Lin)
- mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang)
- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (Xu Wang)
- iio: st_lsm6dsx: Fixed calibrated timestamp calculation (Mario Tesi)
- net: fec: do not register PPS event for PEROUT (Wei Fang)
- net: fec: do not allow enabling PPS and PEROUT simultaneously (Wei Fang)
- net: fec: do not update PEROUT if it is enabled (Wei Fang)
- net: fec: cancel perout_timer when PEROUT is disabled (Wei Fang)
- net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773728] {CVE-2025-68301}
- eth: fbnic: Fix counter roll-over issue (Mohsin Bashir)
- net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean)
- net: dsa: sja1105: simplify static configuration reload (Russell King)
- net: wwan: mhi: Keep modem name match with Foxconn T99W640 (Slark Xiao)
- drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (Alex Deucher)
- net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev)
- team: Move team device type change at the end of team_port_add (Nikola Z. Ivanov) [Orabug: 38796270] {CVE-2025-68340}
- net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino)
- drm/xe: Fix conversion from clock ticks to milliseconds (Harish Chegondi)
- net: lan966x: Fix the initialization of taprio (Horatiu Vultur)
- net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng)
- platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter)
- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (Daniel Golle)
- veth: reduce XDP no_direct return section to fix race (Jesper Dangaard Brouer) [Orabug: 38796276] {CVE-2025-68341}
- veth: more robust handing of race to avoid txq getting stuck (Jesper Dangaard Brouer)
- veth: prevent NULL pointer dereference in veth_xdp_rcv (Jesper Dangaard Brouer)
- veth: apply qdisc backpressure on full ptr_ring to reduce TX drops (Jesper Dangaard Brouer)
- net: sched: generalize check for no-queue qdisc on TX queue (Jesper Dangaard Brouer)
- Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz)
- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (Edward Adam Davis) [Orabug: 38773949] {CVE-2025-68305}
- Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP (Luiz Augusto von Dentz)
- Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface (Chris Lu) [Orabug: 38773748] {CVE-2025-68306}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data (Marc Kleine-Budde) [Orabug: 38796278] {CVE-2025-68342}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header (Marc Kleine-Budde) [Orabug: 38796285] {CVE-2025-68343}
- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (Marc Kleine-Budde) [Orabug: 38773751] {CVE-2025-68307}
- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [Orabug: 38773759] {CVE-2025-68308}
- LTS version: v6.12.60 (Jack Vogel)
- Revert "gpio: swnode: don't use the swnode's name as the key for GPIO lookup" (Charles Keepax)
- drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched (Fangzhi Zuo)
- drm/amd/display: Insert dccg log for easy debug (Charlene Liu)
- drm/amd/display: disable DPP RCG before DPP CLK enable (Charlene Liu)
- drm/amd/display: avoid reset DTBCLK at clock init (Charlene Liu)
- xfs: fix out of bounds memory read error in symlink repair (Darrick J. Wong) [Orabug: 38730602] {CVE-2025-40246}
- xfs: Replace strncpy with memcpy (Marcelo Moreira)
- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730655] {CVE-2025-40257}
- drm/i915/dp_mst: Disable Panel Replay (Imre Deak)
- maple_tree: fix tracepoint string pointers (Martin Kaiser)
- tty/vt: fix up incorrect backport to stable releases (Jari Ruusu)
- smb: client: fix incomplete backport in cfids_invalidation_worker() (Henrique Carvalho)
- drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (Samuel Zhang) [Orabug: 38773445] {CVE-2025-68230}
- tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun)
- net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
- ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe)
- s390/mm: Fix __ptep_rdp() inline assembly (Heiko Carstens)
- drm/xe: Prevent BIT() overflow when handling invalid prefetch region (Shuicheng Lin)
- Revert "RDMA/irdma: Update Kconfig" (Guan Wentao)
- KVM: arm64: Make all 32bit ID registers fully writable (Marc Zyngier)
- ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai)
- kconfig/nconf: Initialize the default locale at startup (Jakub Horký)
- kconfig/mconf: Initialize the default locale at startup (Jakub Horký)
- net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit)
- blk-crypto: use BLK_STS_INVAL for alignment errors (Carlos Llamas)
- net: tls: Change async resync helpers argument (Shahar Shitrit)
- selftests: net: use BASH for bareudp testing (Po-Hsu Lin)
- x86/microcode/AMD: Limit Entrysign signature checking to known generations (Borislav Petkov)
- scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773425] {CVE-2025-68224}
- cifs: fix typo in enable_gcm_256 module parameter (Steve French)
- bcma: don't register devices disabled in OF (Rafał Miłecki)
- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730610] {CVE-2025-40248}
- cifs: fix memory leak in smb3_fs_context_parse_param error path (Shaurya Rane) [Orabug: 38773403] {CVE-2025-68219}
- LoongArch: Use UAPI types in ptrace UAPI header (Thomas Weißschuh)
- af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic(). (Kuniyuki Iwashima)
- af_unix: Cache state-&gt;msg in unix_stream_read_generic(). (Kuniyuki Iwashima)
- devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (Shay Drory) [Orabug: 38730623] {CVE-2025-40251}
- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (Jared Kangas)
- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (Jared Kangas)
- ice: fix PTP cleanup on driver removal in error path (Grzegorz Nitka) [Orabug: 38773389] {CVE-2025-68215}
- idpf: fix possible vport_config NULL pointer deref in remove (Emil Tantilov) [Orabug: 38773956] {CVE-2025-68213}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730628] {CVE-2025-40252}
- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang)
- selftests: net: lib: Do not overwrite error messages (Ido Schimmel)
- s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
- nvme-multipath: fix lockdep WARN due to partition scan work (Shin'Ichiro Kawasaki) [Orabug: 38773400] {CVE-2025-68218}
- tools: riscv: Fixed misalignment of CSR related definitions (Chen Pei)
- net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730647] {CVE-2025-40254}
- net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() (Pavel Zhigulin)
- net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin)
- drm/tegra: Add call to put_pid() (Prateek Agarwal) [Orabug: 38773463] {CVE-2025-68233}
- mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
- platform/x86: msi-wmi-platform: Fix typo in WMI GUID (Armin Wolf)
- platform/x86: msi-wmi-platform: Only load on MSI devices (Armin Wolf)
- pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() (Xu Wang)
- xfrm: Prevent locally generated packets from direct output in tunnel mode (Jianbo Liu)
- xfrm: Determine inner GSO type from packet inner protocol (Jianbo Liu)
- pinctrl: realtek: Select REGMAP_MMIO for RTD driver (Yu-Chun Lin)
- xfrm: set err and extack on failure to create pcpu SA (Sabrina Dubroca)
- xfrm: drop SA reference in xfrm_state_update if dir doesn't match (Sabrina Dubroca)
- drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 (Ivan Lipski)
- drm/amd/display: Fix pbn to kbps Conversion (Fangzhi Zuo)
- drm/amd/display: Move sleep into each retry for retrieve_link_cap() (Mario Limonciello)
- drm/amd/display: Increase DPCD read retries (Mario Limonciello)
- drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (Yifan Zha)
- drm/amd: Skip power ungate during suspend for VPE (Mario Limonciello)
- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (Robert Mcclinton) [Orabug: 38773418] {CVE-2025-68223}
- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke)
- mptcp: do not fallback when OoO is present (Paolo Abeni)
- mptcp: decouple mptcp fastclose from tcp close (Paolo Abeni)
- mptcp: avoid unneeded subflow-level drops (Paolo Abeni)
- selftests: mptcp: join: userspace: longer timeout (Matthieu Baerts)
- selftests: mptcp: join: endpoints: longer timeout (Matthieu Baerts)
- mptcp: fix premature close in case of fallback (Paolo Abeni)
- mptcp: fix duplicate reset on fastclose (Paolo Abeni)
- mptcp: fix ack generation for fallback msk (Paolo Abeni)
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730658] {CVE-2025-40258}
- LoongArch: Don't panic if no valid cache info for PCI (Huacai Chen)
- dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski)
- MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
- scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773439] {CVE-2025-68229}
- scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730661] {CVE-2025-40259}
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730672] {CVE-2025-40261}
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne)
- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (Nam Cao) [Orabug: 38773467] {CVE-2025-68235}
- mm/mempool: fix poisoning order&gt;0 pages with HIGHMEM (Vlastimil Babka) [Orabug: 38773453] {CVE-2025-68231}
- Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
- Input: imx_sc_key - fix memory corruption on unload (Dan Carpenter)
- Input: goodix - add support for ACPI ID GDIX1003 (Hans de Goede)
- Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730679] {CVE-2025-40263}
- Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" (Diogo Ivo)
- net: dsa: microchip: lan937x: Fix RGMII delay tuning (Oleksij Rempel)
- be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730688] {CVE-2025-40264}
- ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() (Yihang Li)
- smb: client: introduce close_cached_dir_locked() (Henrique Carvalho)
- ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
- mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773434] {CVE-2025-68227}
- mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen)
- exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang)
- shmem: fix tmpfs reconfiguration (remount) when noswap is set (Mike Yuan)
- isofs: check the return value of sb_min_blocksize() in isofs_fill_super (Yongpeng Yang)
- mtdchar: fix integer overflow in read/write ioctls (Dan Carpenter) [Orabug: 38773476] {CVE-2025-68237}
- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara)
- arm64: dts: rockchip: disable HS400 on RK3588 Tiger (Quentin Schulz)
- arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1 (Quentin Schulz)
- arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5 (Mykola Kvach)
- arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2 (Diederik de Haas)
- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
- HID: amd_sfh: Stop sensor before starting (Mario Limonciello)
- timers: Fix NULL function pointer race in timer_shutdown_sync() (Yipeng Zou) [Orabug: 38773387] {CVE-2025-68214}
- KVM: arm64: Check the untrusted offset in FF-A memory share (Sebastian Ene) [Orabug: 38730696] {CVE-2025-40266}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.2.el10uek]" date="1766491200">- LTS version: v6.12.63 (Jack Vogel)
- ASoC: codecs: nau8325: Silence uninitialized variables warnings (Krzysztof Kozlowski)
- ALSA: wavefront: Fix integer overflow in sample size validation (Junrui Luo)
- ALSA: dice: fix buffer overflow in detect_stream_formats() (Junrui Luo)
- usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required (Sven Peter)
- usb: phy: Initialize struct usb_phy list_head (Diogo Ivo)
- usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (Haotien Hsu)
- tcp_metrics: use dst_dev_net_rcu() (Eric Dumazet) [Orabug: 38592188] {CVE-2025-40075}
- net: dst: introduce dst-&gt;dev_rcu (Eric Dumazet)
- net: lan743x: Allocate rings outside ZONE_DMA (Thangaraj Samynathan)
- LoongArch: Add machine_kexec_mask_interrupts() implementation (Huacai Chen)
- ocfs2: fix memory leak in ocfs2_merge_rec_left() (Dmitry Antipov)
- irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (Dan Carpenter)
- scsi: imm: Fix use-after-free bug caused by unfinished delayed work (Duoming Zhou) [Orabug: 38783113] {CVE-2025-68324}
- efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs (Mauro Carvalho Chehab)
- efi/cper: Adjust infopfx size to accept an extra space (Mauro Carvalho Chehab)
- efi/cper: Add a new helper function to print bitmasks (Mauro Carvalho Chehab)
- dm log-writes: Add missing set_freezable() for freezable kthread (Xu Wang)
- dm-raid: fix possible NULL dereference with undefined raid type (Alexey Simakov)
- block: return unsigned int from queue_dma_alignment (Christoph Hellwig)
- block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set-&gt;tag_list_lock (Mohamed Khalfella) [Orabug: 38818209] {CVE-2025-68756}
- ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() (Pangliyuan)
- ALSA: firewire-motu: add bounds check in put_user loop for DSP events (Junrui Luo)
- rtc: gamecube: Check the return value of ioremap() (Xu Wang)
- drm/amdkfd: Use huge page size to check split svm range alignment (Xiaogang Chen)
- ALSA: uapi: Fix typo in asound.h comment (Andres J Rosa)
- docs: hwmon: fix link to g762 devicetree binding (Kathara Sasikumar)
- cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 (David Howells)
- drm/nouveau: refactor deprecated strcpy (Madhur Kumar)
- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (Junrui Luo)
- regulator: fixed: Rely on the core freeing the enable GPIO (Mark Brown)
- drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() (Dan Carpenter)
- nvme-auth: use kvfree() for memory allocated with kvcalloc() (Israel Rukshin)
- block: fix memory leak in __blkdev_issue_zero_pages (Shaurya Rane) [Orabug: 38798772] {CVE-2025-68348}
- block: fix comment for op_is_zone_mgmt() to include RESET_ALL (Shechenglong)
- blk-mq: Abort suspend when wakeup events are pending (Cong Zhang)
- ASoC: ak5558: Disable regulator when error happens (Shengjiu Wang)
- ASoC: ak4458: Disable regulator when error happens (Shengjiu Wang)
- ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (Xu Wang)
- platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (Anton Khirnov)
- fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() (Armin Wolf)
- NFS: Fix inheritance of the block sizes when automounting (Trond Myklebust)
- Expand the type of nfs_fattr-&gt;valid (Trond Myklebust)
- NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (Trond Myklebust) [Orabug: 38818236] {CVE-2025-68764}
- Revert "nfs: ignore SB_RDONLY when mounting nfs" (Trond Myklebust)
- Revert "nfs: clear SB_RDONLY before getting superblock" (Trond Myklebust)
- Revert "nfs: ignore SB_RDONLY when remounting nfs" (Trond Myklebust)
- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (Jonathan Curley) [Orabug: 38798774] {CVE-2025-68349}
- NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state (Trond Myklebust)
- nfs/vfs: discard d_exact_alias() (Neil Brown)
- NFS: Initialise verifiers for visible dentries in nfs_atomic_open() (Trond Myklebust)
- NFS: Initialise verifiers for visible dentries in readdir and lookup (Trond Myklebust)
- fs/nls: Fix utf16 to utf8 conversion (Armin Wolf)
- NFS: Avoid changing nlink when file removes and attribute updates race (Trond Myklebust)
- f2fs: maintain one time GC mode is enabled during whole zoned GC cycle (Daeho Jeong)
- f2fs: add gc_boost_gc_greedy sysfs node (Daeho Jeong)
- f2fs: add gc_boost_gc_multiple sysfs node (Daeho Jeong)
- f2fs: introduce reserved_pin_section sysfs entry (Chao Yu)
- f2fs: sysfs: add encoding_flags entry (Chao Yu)
- f2fs: add carve_out sysfs node (Daeho Jeong)
- f2fs: fix to avoid running out of free segments (Chao Yu)
- f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages (Jaegeuk Kim)
- f2fs: keep POSIX_FADV_NOREUSE ranges (Jaegeuk Kim)
- platform/x86:intel/pmc: Update Arrow Lake telemetry GUID (Xi Pardee)
- sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out (Xupengbo)
- 9p: fix cache/debug options printing in v9fs_show_options (Eric Sandeen)
- fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (Abdun Nihaal)
- pinctrl: single: Fix incorrect type for error return variable (Xu Wang)
- perf hist: In init, ensure mem_info is put on error paths (Ian Rogers)
- perf tools: Fix split kallsyms DSO counting (Namhyung Kim)
- perf tools: Mark split kallsyms DSOs as loaded (Namhyung Kim)
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei) [Orabug: 38783136] {CVE-2025-68325}
- net: dsa: xrs700x: reject unsupported HSR configurations (Vladimir Oltean)
- net: hsr: create an API to get hsr port type (Xiaoliang Yang)
- net: hsr: Create and export hsr_get_port_ndev() (Md Danish Anwar)
- net: hsr: remove synchronize_rcu() from hsr_add_port() (Eric Dumazet)
- net: hsr: remove one synchronize_rcu() from hsr_del_port() (Eric Dumazet)
- clk: keystone: fix compile testing (Johan Hovold)
- md/raid5: fix IO hang when array is broken with IO inflight (Yu Kuai)
- remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs (Alexandru Gagniuc)
- mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (Ivan Stepchenko)
- selftests: bonding: add delay before each xvlan_over_bond connectivity check (Hangbin Liu)
- selftests: bonding: add ipvlan over bond testing (Etienne Champetier)
- net: phy: aquantia: check for NVMEM deferral (Robert Marko)
- vfio/pci: Use RCU for error/request triggers to avoid circular locking (Alex Williamson)
- spi: ch341: fix out-of-bounds memory access in ch341_transfer_one (Tianchu Chen)
- mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (Xu Wang)
- net: stmmac: fix rx limit check in stmmac_rx_zc() (Alexey Kodanev)
- netfilter: nft_connlimit: update the count if add was skipped (Fernando Fernandez Mancera)
- netfilter: nf_conncount: rework API to use sk_buff directly (Fernando Fernandez Mancera)
- netfilter: flowtable: check for maximum number of encapsulations in bridge vlan (Pablo Neira Ayuso)
- Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" (Ilias Stamatis)
- resource: introduce is_type_match() helper and use it (Andy Shevchenko)
- resource: replace open coded resource_intersection() (Andy Shevchenko)
- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (Sparkhuang) [Orabug: 38798786] {CVE-2025-68354}
- ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND (Mikhail Kshevetskiy)
- ASoC: Intel: catpt: Fix error path in hw_params() (Cezary Rojewski)
- vdpa/pds: use %pe for ERR_PTR() in event handler registration (Alok Tiwari)
- vhost: Fix kthread worker cgroup failure handling (Mike Christie)
- vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues (Alok Tiwari)
- virtio: fix virtqueue_set_affinity() docs (Michael S. Tsirkin)
- virtio: fix grammar in virtio_queue_info docs (Michael S. Tsirkin)
- virtio: fix whitespace in virtio_config_ops (Michael S. Tsirkin)
- virtio: fix typo in virtio_device_ready() comment (Michael S. Tsirkin)
- virtio_vdpa: fix misleading return in void function (Alok Tiwari)
- of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node (Guenter Roeck)
- ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation (Yongjian Sun)
- ublk: prevent invalid access with DEBUG (Kevin Brodsky)
- ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (René Rebe)
- hwmon: sy7636a: Fix regulator_enable resource leak on error path (Xu Wang)
- drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (Dan Carpenter)
- greybus: gb-beagleplay: Fix timeout handling in bootloader functions (Xu Wang)
- firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER (Alexandre Courbot)
- ASoC: fsl_xcvr: clear the channel status control memory (Shengjiu Wang)
- gfs2: Prevent recursive memory reclaim (Andreas Gruenbacher) [Orabug: 38798793] {CVE-2025-68356}
- ASoC: nau8325: add missing build config (Jaroslav Kysela)
- ASoC: nau8325: use simple i2c probe function (Jaroslav Kysela)
- drm/panthor: Avoid adding of kernel BOs to extobj list (Akash Goel)
- RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY (Jacob Moroni)
- RDMA/irdma: Fix data race in irdma_free_pble (Krzysztof Czurylo)
- RDMA/irdma: Fix data race in irdma_sc_ccq_arm (Krzysztof Czurylo)
- iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal (Stephan Gerhold)
- backlight: lp855x: Fix lp855x.h kernel-doc warnings (Randy Dunlap)
- backlight: led-bl: Add devlink to supplier LEDs (Luca Ceresoli)
- wifi: ieee80211: correct FILS status codes (Ria Thomas)
- iomap: always run error completions in user context (Christoph Hellwig)
- iomap: factor out a iomap_dio_done helper (Christoph Hellwig)
- um: Don't rename vmap to kernel_vmap (David Gow)
- drm/nouveau: restrict the flush page to a 32-bit address (Timur Tabi)
- PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (Shawn Lin)
- btrfs: fix leaf leak in an error path in btrfs_del_items() (Filipe Manana)
- iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables (Ryan Huang)
- staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (Jianglei Nie)
- firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (Dinh Nguyen)
- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (Zilin Guan)
- ASoC: tas2781: correct the wrong period (Shenghao Ding)
- RDMA/bnxt_re: Pass correct flag for dma mr creation (Selvin Xavier)
- RDMA/bnxt_re: Fix the inline size for GenP7 devices (Selvin Xavier)
- erofs: limit the level of fs stacking for file-backed mounts (Gao Xiang)
- RISC-V: KVM: Fix guest page fault within HLV* instructions (Fangyu Yu)
- crypto: ccree - Correctly handle return of sg_nents_for_len (Xu Wang)
- crypto: starfive - Correctly handle return of sg_nents_for_len (Xu Wang)
- selftests/bpf: Improve reliability of test_perf_branches_no_hw() (Matt Bobrowski)
- selftests/bpf: skip test_perf_branches_hw() on unsupported platforms (Matt Bobrowski)
- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon)
- usb: dwc2: fix hang during suspend if set as peripheral (Jisheng Zhang)
- usb: dwc2: fix hang during shutdown if set as peripheral (Jisheng Zhang)
- usb: dwc2: disable platform lowlevel hw resources during shutdown (Jisheng Zhang)
- usb: chaoskey: fix locking for O_NONBLOCK (Oliver Neukum)
- ima: Handle error code returned by ima_filter_rule_match() (Zhao Yipeng) [Orabug: 38798921] {CVE-2025-68740}
- RAS: Report all ARM processor CPER information to userspace (Jason Tian)
- wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (Seungjin Bae) [Orabug: 38798814] {CVE-2025-68362}
- cpuset: Treat cpusets in attaching as populated (Chen Ridong)
- net: phy: adin1100: Fix software power-down ready condition (Alexander Dahl)
- phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth (Cristian Ciocaltea)
- phy: freescale: Initialize priv-&gt;lock (Xiaolei Wang)
- phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (Christophe Jaillet)
- leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM (Fenglin Wu)
- mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- wifi: mac80211: fix CMAC functions not handling errors (Chien Wong)
- iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb (Aashish Sharma)
- scsi: qla2xxx: Fix improper freeing of purex item (Zilin Guan) [Orabug: 38798928] {CVE-2025-68741}
- pwm: bcm2835: Make sure the channel is enabled after pwm_request() (Uwe Kleine-König)
- perf arm_spe: Fix memset subclass in operation (Leo Yan)
- perf arm-spe: Extend branch operations (Leo Yan)
- ipv6: clear RA flags when adding a static route (Fernando Fernandez Mancera)
- drm/msm/a6xx: Improve MX rail fallback in RPMH vote init (Akhil P Oommen)
- drm/msm/a6xx: Fix the gemnoc workaround (Akhil P Oommen)
- drm/msm/a6xx: Flush LRZ cache before PT switch (Akhil P Oommen)
- drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (Jay Liu)
- fs/ntfs3: Prevent memory leaks in add sub record (Edward Adam Davis)
- fs/ntfs3: out1 also needs to put mi (Edward Adam Davis)
- powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format (Ritesh Harjani)
- powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit (Ritesh Harjani)
- bpf: Fix invalid prog-&gt;stats access when update_effective_progs fails (Pu Lehui) [Orabug: 38798931] {CVE-2025-68742}
- wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (Abdun Nihaal) [Orabug: 38818221] {CVE-2025-68759}
- drm/msm/a2xx: stop over-complaining about the legacy firmware (Dmitry Baryshkov)
- block/blk-throttle: Fix throttle slice time for SSDs (Guenter Roeck)
- NFSD/blocklayout: Fix minlength check in proc_layoutget (Sergey Bashirov)
- tracefs: fix a leak in eventfs_create_events_dir() (Al Viro)
- watchdog: starfive: Fix resource leak in probe error path (Xu Wang)
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (Xu Wang)
- bpf: Check skb-&gt;transport_header is set in bpf_skb_check_mtu (Martin Kafai Lau) [Orabug: 38798820] {CVE-2025-68363}
- selftests/bpf: Fix failure paths in send_signal test (Alexei Starovoitov)
- bpf: Handle return value of ftrace_set_filter_ip in register_fentry (Menglong Dong)
- ps3disk: use memcpy_{from,to}_bvec index (René Rebe)
- drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype (Dmitry Baryshkov)
- crypto: iaa - Fix incorrect return value in save_iaa_wq() (Zilin Guan)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C (Fukaumi Naoki)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A (Fukaumi Naoki)
- arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A (Fukaumi Naoki)
- PCI: keystone: Exit ks_pcie_probe() for invalid mode (Siddharth Vadapalli)
- bpf: Free special fields when update [lru_,]percpu_hash maps (Leon Hwang) [Orabug: 38798936] {CVE-2025-68744}
- leds: netxbig: Fix GPIO descriptor leak in error paths (Xu Wang)
- scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls (Xu Wang)
- ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (Xu Wang)
- ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() (Dmitry Antipov) [Orabug: 38798823] {CVE-2025-68364}
- lib/vsprintf: Check pointer before dereferencing in time_and_date() (Andy Shevchenko)
- clk: renesas: r9a06g032: Fix memory leak in error path (Xu Wang)
- coresight: etm4x: Add context synchronization before enabling trace (Leo Yan)
- coresight: etm4x: Extract the trace unit controlling (Leo Yan)
- coresight: etm4x: Correct polling IDLE bit (Leo Yan)
- coresight: Change device mode to atomic type (Leo Yan)
- nbd: defer config unlock in nbd_genl_connect (Zheng Qixing) [Orabug: 38798832] {CVE-2025-68366}
- wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (Abdun Nihaal)
- macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (Long Li) [Orabug: 38798837] {CVE-2025-68367}
- powerpc/32: Fix unpaired stwcx. on interrupt exit (Christophe Leroy)
- powerpc/kdump: Fix size calculation for hot-removed memory ranges (Sourabh Jain)
- cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs (Gautham R. Shenoy)
- scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() (Bean Huo)
- drm/panthor: Fix potential memleak of vma structure (Akash Goel)
- ntfs3: init run lock for extend inode (Edward Adam Davis)
- ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties (Jihed Chaibi)
- RDMA/rtrs: server: Fix error handling in get_or_create_srv (Ma Ke)
- dt-bindings: PCI: amlogic: Fix the register name of the DBI region (Manivannan Sadhasivam)
- scsi: smartpqi: Fix device resources accessed after device removal (Mike Mcgowen) [Orabug: 38798847] {CVE-2025-68371}
- scsi: stex: Fix reboot_notifier leak in probe error path (Xu Wang)
- nbd: defer config put in recv_work (Zheng Qixing) [Orabug: 38798850] {CVE-2025-68372}
- md: fix rcu protection in md_wakeup_thread (Yun Zhou) [Orabug: 38798857] {CVE-2025-68374}
- regulator: core: disable supply if enabling main regulator fails (Gabor Juhos)
- perf/x86/intel: Correct large PEBS flag check (Dapeng Mi)
- ext4: correct the checking of quota files before moving extents (Zhang Yi)
- mfd: da9055: Fix missing regmap_del_irq_chip() in error path (Xu Wang)
- locktorture: Fix memory leak in param_set_cpumask() (Wang Liang)
- efi/libstub: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- x86/boot: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels (Yegor Yefremov)
- libbpf: Fix parsing of multi-split BTF (Alan Maguire)
- spi: tegra210-quad: Fix timeout handling (Vishwaroop A) [Orabug: 38798943] {CVE-2025-68746}
- drm/panthor: Fix UAF on kernel BO VA nodes (Boris Brezillon)
- drm/panthor: Fix race with suspend during unplug (Ketil Johnsen)
- drm/panthor: Fix UAF race between device unplug and FW event processing (Ketil Johnsen)
- drm/panthor: Fix group_free_queue() for partially initialized queues (Boris Brezillon)
- drm/panthor: Handle errors returned by drm_sched_entity_init() (Boris Brezillon)
- fs/9p: Don't open remote file with APPEND mode when writeback cache is used (Tingmao Wang)
- scsi: target: Do not write NUL characters into ASCII configfs output (Bart Van Assche)
- power: supply: apm_power: only unset own apm_get_power_status (Ahelenia Ziemiańska)
- power: supply: wm831x: Check wm831x_set_bits() return value (Ivan Abramov)
- power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (Murad Masimov)
- power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (Ivan Abramov)
- power: supply: max17040: Check iio_read_channel_processed() return code (Ivan Abramov)
- power: supply: cw2015: Check devm_delayed_work_autocancel() return code (Ivan Abramov)
- power: supply: rt5033_charger: Fix device node reference leaks (Xu Wang)
- perf record: skip synthesize event when open evsel failed (Shuai Xue)
- perf lock contention: Load kernel map before lookup (Namhyung Kim)
- drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() (Geert Uytterhoeven)
- interconnect: debugfs: Fix incorrect error handling for NULL path (Kuan-Wei Chiu)
- arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller (Dmitry Baryshkov)
- interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS (Dmitry Baryshkov)
- wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() (Abdun Nihaal)
- i3c: master: svc: Prevent incomplete IBI transaction (Stanley Chu)
- i3c: fix refcount inconsistency in i3c_master_register (Frank Li)
- pinctrl: stm32: fix hwspinlock resource leak in probe function (Xu Wang)
- soc: qcom: smem: fix hwspinlock resource leak in probe error paths (Xu Wang)
- tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set (Benjamin Berg)
- x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() (Tengda Wu)
- task_work: Fix NMI race condition (Peter Zijlstra)
- perf/x86/intel/cstate: Remove PC3 support from LunarLake (Zhang Rui)
- bpf: Fix stackmap overflow check in __bpf_get_stackid() (Arnaud Lecomte) [Orabug: 38798864] {CVE-2025-68378}
- bpf: Refactor stack map trace depth calculation into helper function (Arnaud Lecomte)
- perf: Remove get_perf_callchain() init_nr argument (Josh Poimboeuf)
- mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (Xu Wang)
- mtd: nand: relax ECC parameter validation check (Aryan Srivastava)
- Revert "mtd: rawnand: marvell: fix layouts" (Aryan Srivastava)
- ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties (Wolfram Sang)
- ARM: dts: renesas: gose: Remove superfluous port property (Wolfram Sang)
- RDMA/rxe: Fix null deref on srq-&gt;rq.queue after resize failure (Zhu Yanjun) [Orabug: 38798867] {CVE-2025-68379}
- sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Kuniyuki Iwashima)
- phy: mscc: Fix PTP for VSC8574 and VSC8572 (Horatiu Vultur)
- arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory (Alexander Martinz)
- arm64: dts: qcom: sm8650: set ufs as dma coherent (Neil Armstrong)
- arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider (Gergo Koteles)
- arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller (Krishna Kurapati)
- arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller (Krishna Kurapati)
- firmware: imx: scu-irq: fix OF node leak in (Peng Fan)
- arm64: dts: ti: k3-am62p: Fix memory ranges for GPU (Randolph Sapp)
- s390/ap: Don't leak debug feature files if AP instructions are not available (Heiko Carstens)
- s390/smp: Fix fallback CPU detection (Heiko Carstens)
- wifi: ath11k: fix peer HE MCS assignment (Baochen Qiang) [Orabug: 38798872] {CVE-2025-68380}
- wifi: ath11k: fix VHT MCS assignment (Baochen Qiang)
- crypto: hisilicon/qm - restore original qos values (Nieweiqiang)
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (Thorsten Blum) [Orabug: 38798874] {CVE-2025-68724}
- soc: qcom: gsbi: fix double disable caused by devm (Xu Wang)
- soc: Switch back to struct platform_driver::remove() (Uwe Kleine-König)
- clk: qcom: camcc-sm7150: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (Li Qiang)
- PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (Geert Uytterhoeven)
- arm64: dts: exynos: gs101: fix sysreg_apm reg property (Peter Griffin)
- perf annotate: Check return value of evsel__get_arch() properly (Tianyou Li)
- arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 (Tim Harvey)
- arm64: dts: imx8mp-venice-gw702x: remove off-board uart (Tim Harvey)
- arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl (Tim Harvey)
- arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props (Tim Harvey)
- block/mq-deadline: Switch back to a single dispatch list (Bart Van Assche)
- block/mq-deadline: Introduce dd_start_request() (Bart Van Assche)
- firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc (Randy Dunlap)
- iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (Francesco Lavra)
- inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() (Luoxuanqiang)
- inet: Avoid ehash lookup race in inet_ehash_insert() (Luoxuanqiang)
- rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() (Luoxuanqiang)
- clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets (Stephan Gerhold)
- ntfs3: Fix uninit buffer allocated by __getname() (Sidharth Seela)
- ntfs3: fix uninit memory after failed mi_read in mi_format_new (Raphael Pinsonneault-Thibeault)
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Herbert Xu)
- irqchip/qcom-irq-combiner: Fix section mismatch (Johan Hovold)
- irqchip/starfive-jh8100: Fix section mismatch (Johan Hovold)
- irqchip/renesas-rzg2l: Fix section mismatch (Johan Hovold)
- irqchip/imx-mu-msi: Fix section mismatch (Johan Hovold)
- irqchip/irq-brcmstb-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7120-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7038-l1: Fix section mismatch (Johan Hovold)
- sched/fair: Forfeit vruntime on yield (Fernand Sieber)
- wifi: ath11k: restore register window after global reset (Baochen Qiang)
- wifi: ath10k: move recovery check logic into a new work (Kang Yang)
- wifi: ath10k: Add missing include of export.h (Jeff Johnson)
- wifi: ath10k: Avoid vdev delete timeout when firmware is already down (Loic Poulain)
- objtool: Fix weak symbol detection (Josh Poimboeuf)
- objtool: Fix standalone --hacks=jump_label (Dylan Hatch)
- HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (Mavroudis Chatzilazaridis)
- drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() (Cyrille Pitchen)
- clk: renesas: cpg-mssr: Read back reset registers to assure values latched (Marek Vasut)
- clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register (Thierry Bultel)
- clk: renesas: Use str_on_off() helper (Geert Uytterhoeven)
- clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (Marek Vasut)
- pinctrl: renesas: rzg2l: Fix PMC restore (Biju Das)
- USB: Fix descriptor count when handling invalid MBIM extended descriptor (Seungjin Bae)
- drm/vgem-fence: Fix potential deadlock on release (Janusz Krzysztofik) [Orabug: 38818211] {CVE-2025-68757}
- accel/ivpu: Fix DCT active percent format (Karol Wachowski)
- accel/ivpu: Make function parameter names consistent (Jacek Lawrynowicz)
- drm/panel: visionox-rm69299: Don't clear all mode flags (Guido Günther)
- accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail (Karol Wachowski)
- accel/ivpu: Prevent runtime suspend during context abort work (Andrzej Kacprowski)
- gpu: host1x: Fix race in syncpt alloc/free (Mainak Sen) [Orabug: 38798898] {CVE-2025-68732}
- smack: fix bug: setting task label silently ignores input garbage (Konstantin Andreev)
- smack: fix bug: unprivileged task can create labels (Konstantin Andreev)
- smack: fix bug: invalid label of unix socket file (Konstantin Andreev)
- smack: always "instantiate" inode in smack_inode_init_security() (Konstantin Andreev)
- smack: deduplicate xattr setting in smack_inode_init_security() (Konstantin Andreev)
- smack: fix bug: SMACK64TRANSMUTE set on non-directory (Konstantin Andreev)
- smack: deduplicate "does access rule request transmutation" (Konstantin Andreev)
- net/mlx5e: Set default burst period for TX and RX reporters (Shahar Shitrit) [Orabug: 38636804]
- devlink: Make health reporter burst period configurable (Shahar Shitrit) [Orabug: 38636804]
- devlink: Introduce burst period for health reporter (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move health reporter recovery abort logic to a separate function (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move graceful period parameter to reporter ops (Shahar Shitrit) [Orabug: 38636804]
- devlink: use devlink_nl_put_u64() helper (Przemek Kitszel) [Orabug: 38636804]
- devlink: introduce devlink_nl_put_u64() (Przemek Kitszel) [Orabug: 38636804]
- Revert "net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery" (Qing Huang) [Orabug: 38636804]
- net/rds: improve conn destroy printk message (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: expand kref coverage to rds_notifier-&gt;n_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: rds_sendmsg must use rs_conn only when not being destroyed (Sharath Srinivasan) [Orabug: 38728742]
- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang) [Orabug: 38766139]
- mm: list_lru: avoid using NULL list_lru_one. (Imran Khan) [Orabug: 38787957]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg)
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa)
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn)
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe)
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping)
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen)
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan)
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo) [Orabug: 38847806] {CVE-2025-68789}
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera)
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38649136]  {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.1.el10uek]" date="1769688000">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang)  [Orabug: 38899652]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.2.el10uek]" date="1770897600">- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan)  [Orabug: 38937451]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.3.el10uek]" date="1771329600">- net/rds: Fix issue with a revert in rds_send_queue_rm (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
</package>
<package pkgid="17e8c8560a9aa43775ed8494c05ea4225588ee01" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="109.67.6.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg) [Orabug: 38887626] {CVE-2025-71156}
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa) [Orabug: 38887628] {CVE-2025-71157}
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn) [Orabug: 38887618] {CVE-2025-71154}
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe) [Orabug: 38887603] {CVE-2025-71149}
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping) [Orabug: 38887600] {CVE-2025-71148}
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen) [Orabug: 38887596] {CVE-2025-71147}
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan) [Orabug: 38887608] {CVE-2025-71151}
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo)
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera) [Orabug: 38887785] {CVE-2025-71146}
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.6.el10uek]" date="1772884800">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong)  [Orabug: 39027305]</changelog>
</package>
<package pkgid="599d4173dd26e758e12163b6d8ce385ba7f890c3" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="109.67.6.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg) [Orabug: 38887626] {CVE-2025-71156}
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa) [Orabug: 38887628] {CVE-2025-71157}
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn) [Orabug: 38887618] {CVE-2025-71154}
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe) [Orabug: 38887603] {CVE-2025-71149}
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping) [Orabug: 38887600] {CVE-2025-71148}
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen) [Orabug: 38887596] {CVE-2025-71147}
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan) [Orabug: 38887608] {CVE-2025-71151}
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo)
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera) [Orabug: 38887785] {CVE-2025-71146}
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.6.el10uek]" date="1772884800">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong)  [Orabug: 39027305]</changelog>
</package>
<package pkgid="44c1bcb8d2ca9f1bcd4f2c0c4128531d043cf08d" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315]</changelog>
</package>
<package pkgid="b25e86f48ed751bb7a5e961ef355e0e2d437e0e9" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="200.74.27.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315]</changelog>
</package>
<package pkgid="183855df98d5d646459c622d8dca52217e32e07a" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-200.74.27.2.el10uek]" date="1775649600">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39186444]  {CVE-2025-40135} 
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39181102]  {CVE-2026-23231} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39181101]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="db33ca16c0d202c18e1b0bc33672394998729f8f" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="200.74.27.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-200.74.27.2.el10uek]" date="1775649600">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39186444]  {CVE-2025-40135} 
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39181102]  {CVE-2026-23231} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39181101]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="fe8840c6af13c6522cddcce64daac79ef2e5deb7" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]  
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]  
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
</package>
<package pkgid="0ab4dc0f353a195633656ae1194c2b1fd2ce66a3" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="200.74.27.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]  
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]  
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
</package>
<package pkgid="5895818c05fab9da63fb3708b4f9c6814de63633" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]  
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]  
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="d15aba461e3112eec3a77351c453a121f8f1b86e" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="201.74.2.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]  
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]  
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="6d48a1981c7e9e1d6979566a591786874d0cf52c" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]  
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]  
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431} 
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]  
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]  
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]  
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
</package>
<package pkgid="89ecb8a2384d83a6b4807d7a6c8982dc3bb7f940" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="201.74.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]  
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]  
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431} 
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]  
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]  
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]  
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
</package>
<package pkgid="5d0cefd27d206155d46ad2955d8dc5374db746d8" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-201.74.2.3.el10uek]" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39342689]  {CVE-2026-43500} 
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39342689]  
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39342689]  
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39342689]  
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39342689]  {CVE-2026-43284}</changelog>
</package>
<package pkgid="a35f28ea5dd62a8b4ec9c4688e5e2082ff638482" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="201.74.2.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-201.74.2.3.el10uek]" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39342689]  {CVE-2026-43500} 
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39342689]  
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39342689]  
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39342689]  
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39342689]  {CVE-2026-43284}</changelog>
</package>
<package pkgid="ff80a47036779090a8f7bbb4606424e0f38e7389" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck)
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park)
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong)
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck)
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu)
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong)
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N)
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He)
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin)
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian)
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko)
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu)
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N)
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo)
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement)
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K)
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen)
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy)
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle)
- kexec: derive purgatory entry from symbol (Li Chen)
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao)
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez)
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey)
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang)
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev)
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong)
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong)
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson)
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo)
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig)
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav)
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed)
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang)
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao)
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal)
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal)
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li)
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li)
- media: radio-keene: fix memory leak in error path (Shaurya Rane)
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack)
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack)
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack)
- HID: hid-pl: handle probe errors (Oliver Neukum)
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson)
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers)
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han)
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian)
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski)
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu)
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni)
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo)
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi)
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo)
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa)
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen)
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai)
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt)
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov)
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal)
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li)
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni)
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek)
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui)
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith)
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith)
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai)
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan)
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan)
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus)
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook)
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek)
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin)
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu)
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao)
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi)
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen)
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang)
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li)
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab)
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab)
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab)
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab)
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang)
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho)
- gfs2: fiemap page fault fix (Andreas Gruenbacher)
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang)
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn)
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150]
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116]
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972]
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500} 
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]  
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513]  
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]  
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]  
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]  
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284} 
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
</package>
<package pkgid="2a18853b4405d162d1582c0a6b53bb4dda7ec56e" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="202.76.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck)
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park)
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong)
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck)
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu)
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong)
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N)
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He)
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin)
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian)
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko)
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu)
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N)
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo)
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement)
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K)
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen)
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy)
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle)
- kexec: derive purgatory entry from symbol (Li Chen)
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao)
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez)
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey)
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang)
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev)
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong)
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong)
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson)
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo)
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig)
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav)
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed)
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang)
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao)
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal)
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal)
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li)
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li)
- media: radio-keene: fix memory leak in error path (Shaurya Rane)
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack)
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack)
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack)
- HID: hid-pl: handle probe errors (Oliver Neukum)
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson)
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers)
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han)
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian)
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski)
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu)
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni)
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo)
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi)
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo)
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa)
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen)
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai)
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt)
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov)
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal)
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li)
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni)
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek)
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui)
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith)
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith)
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai)
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan)
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan)
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus)
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook)
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek)
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin)
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu)
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao)
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi)
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen)
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang)
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li)
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab)
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab)
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab)
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab)
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang)
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho)
- gfs2: fiemap page fault fix (Andreas Gruenbacher)
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang)
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn)
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150]
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116]
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972]
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500} 
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]  
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513]  
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]  
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]  
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]  
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284} 
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
</package>
<package pkgid="30b7776f751a5133070ce28834d7f9a513085c27" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974] {CVE-2026-43129}
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270} 
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278} 
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
</package>
<package pkgid="2b9a45f7c730dc2088f2dc27327e0bbae5fb1548" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="202.76.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974] {CVE-2026-43129}
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270} 
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278} 
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
</package>
<package pkgid="b343de34707f71796113472f30c8aae0a2637e4f" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278}
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-202.76.4.3.el10uek]" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391434]  {CVE-2026-46333}</changelog>
</package>
<package pkgid="c6f5ed46c725519c1c1736e158b99049700ece6c" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="202.76.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278}
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-202.76.4.3.el10uek]" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391434]  {CVE-2026-46333}</changelog>
</package>
<package pkgid="ca7e857fa8b4db20f82655c09d676cf3f3fb8150" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278}
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-202.76.4.3.el10uek]" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391434]  {CVE-2026-46333}</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.4.el10uek]" date="1779364800">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39420559]  {CVE-2026-46300} 
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39420559]</changelog>
</package>
<package pkgid="a1c97c3203e4e5c3054c394a70a41260865410d8" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="202.76.4.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278}
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-202.76.4.3.el10uek]" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391434]  {CVE-2026-46333}</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.4.el10uek]" date="1779364800">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39420559]  {CVE-2026-46300} 
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39420559]</changelog>
</package>
<package pkgid="2522502fe54520f040cf3e739a614be518f5fcf7" name="kernel-uek" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="203.76.7.1.el10uek"/>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) [Orabug: 39227772] {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) [Orabug: 39251164] {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) [Orabug: 39251169] {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) [Orabug: 39262447] {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) [Orabug: 39331678] {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) [Orabug: 39331784] {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) [Orabug: 39300554] {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) [Orabug: 39331889] {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) [Orabug: 39331303] {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) [Orabug: 39331577] {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) [Orabug: 39339241] {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) [Orabug: 39343623] {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) [Orabug: 39331924] {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) [Orabug: 39331696] {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) [Orabug: 39331680] {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) [Orabug: 39331661] {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) [Orabug: 39331512] {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) [Orabug: 39331937] {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) [Orabug: 39331435] {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) [Orabug: 39331422] {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) [Orabug: 39343538] {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) [Orabug: 39331504] {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) [Orabug: 39331827] {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) [Orabug: 39343546] {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) [Orabug: 39331482] {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) [Orabug: 39331693] {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) [Orabug: 39331458] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) [Orabug: 39331580] {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) [Orabug: 39331409] {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) [Orabug: 39331341] {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) [Orabug: 39331444] {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) [Orabug: 39331510] {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) [Orabug: 39331358] {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) [Orabug: 39331954] {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) [Orabug: 39331545] {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) [Orabug: 39331821] {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) [Orabug: 39331705] {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) [Orabug: 39331366] {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) [Orabug: 39331866] {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) [Orabug: 39331752] {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) [Orabug: 39331370] {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) [Orabug: 39331846] {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) [Orabug: 39331389] {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) [Orabug: 39331440] {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) [Orabug: 39343613] {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) [Orabug: 39331353] {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) [Orabug: 39331023] {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) [Orabug: 39331012] {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) [Orabug: 39331761] {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) [Orabug: 39331606] {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) [Orabug: 39331628] {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) [Orabug: 39331331] {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) [Orabug: 39331449] {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) [Orabug: 39331361] {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) [Orabug: 39331875] {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) [Orabug: 39331549] {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) [Orabug: 39331496] {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) [Orabug: 39331383] {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) [Orabug: 39331959] {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) [Orabug: 39343626] {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [Orabug: 39343577] {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) [Orabug: 39331591] {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) [Orabug: 39343531] {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) [Orabug: 39331853] {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) [Orabug: 39331859] {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) [Orabug: 39343609] {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) [Orabug: 39331003] {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) [Orabug: 39343515] {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) [Orabug: 39331318] {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) [Orabug: 39331375] {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) [Orabug: 39343527] {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) [Orabug: 39331585] {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) [Orabug: 39343616] {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) [Orabug: 39331719] {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) [Orabug: 39331807] {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) [Orabug: 39343628] {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) [Orabug: 39331070] {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) [Orabug: 39331308] {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) [Orabug: 39343581] {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) [Orabug: 39331918] {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) [Orabug: 39343603] {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) [Orabug: 39331896] {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) [Orabug: 39331636] {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) [Orabug: 39331947] {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) [Orabug: 39331518] {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) [Orabug: 39331877] {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) [Orabug: 39331789] {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) [Orabug: 39331882] {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) [Orabug: 39331312] {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) [Orabug: 39331077] {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 38649060,39186444,39202432] {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet) [Orabug: 38887740,39181101,39202431] {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera) [Orabug: 39029337,39131054] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe) [Orabug: 39144150,39343763] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao) [Orabug: 38970584,39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A) [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu) [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu) [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu) [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu) [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu) [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski) [Orabug: 39166116]</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.1.el10uek]" date="1776772800">- Revert "EDAC: Octeon: Init SDEI" (Jeremy Tang) [Orabug: 39203407]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.2.el10uek]" date="1777464000">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman) [Orabug: 39276980]
- uek-rpm/config-aarch64: Enable NVIDIA-recommended Vera-Rubin configs (Vijay Kumar) [Orabug: 39157707]
- kselftest/arm64: Add HWCAP test for FEAT_LS64 (Yicong Yang) [Orabug: 39157707]
- arm64: Provide basic EL2 setup for FEAT_{LS64, LS64_V} usage at EL0/1 (Yicong Yang) [Orabug: 39157707]
- perf: arm_spe: Relax period restriction (Leo Yan) [Orabug: 39157707]
- perf/arm_cspmu: Add PMEVFILT2R support (Robin Murphy) [Orabug: 39157707]
- ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional (Lifeng Zheng) [Orabug: 39157707]
- dt-bindings: gpio: Add Tegra256 support (Prathamesh Shete) [Orabug: 39157707]
- perf/arm_cspmu: nvidia: Add revision id matching (Besar Wicaksono) [Orabug: 39157707]
- arm64: Handle BRBE booting requirements (Anshuman Khandual) [Orabug: 39157707]
- arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again (Rob Herring) [Orabug: 39157707]
- arm64/gcs: Provide basic EL2 setup to allow GCS usage at EL0 and EL1 (Mark Brown) [Orabug: 39157707]
- tools headers arm64: Add NVIDIA Olympus part (Besar Wicaksono) [Orabug: 39157707]
- perf arm-spe: Add NVIDIA Olympus to neoverse list (Besar Wicaksono) [Orabug: 39157707]
- perf arm_spe: Add CPU variants supporting common data source packet (Leo Yan) [Orabug: 39157707]
- arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Yicong Yang) [Orabug: 39157707]
- perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Yicong Yang) [Orabug: 39157707]
- perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions (Yicong Yang) [Orabug: 39157707]
- perf/arm_cspmu: nvidia: Add pmevfiltr2 support (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Add pmpidr support (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Move register definitons to header (Robin Murphy) [Orabug: 39157707]
- perf/arm_cspmu: Add callback to reset filter config (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Generalise event filtering (Robin Murphy) [Orabug: 39157707]
- perf: arm_pmuv3: Add support for the Branch Record Buffer Extension (BRBE) (Rob Herring) [Orabug: 39157707]
- arm64/sysreg: Add BRBE registers and fields (Anshuman Khandual) [Orabug: 39157707]
- perf: arm_pmu: Move PMUv3-specific data (Mark Rutland) [Orabug: 39157707]
- perf: apple_m1: Don't disable counter in m1_pmu_enable_event() (Rob Herring) [Orabug: 39157707]
- perf: arm_v7_pmu: Don't disable counter in (armv7|krait_|scorpion_)pmu_enable_event() (Rob Herring) [Orabug: 39157707]
- perf: arm_v7_pmu: Drop obvious comments for enabling/disabling counters and interrupts (Rob Herring) [Orabug: 39157707]
- perf: arm_pmuv3: Don't disable counter in armv8pmu_enable_event() (Mark Rutland) [Orabug: 39157707]
- ACPI: CPPC: Rename EPP constants for clarity (Sumit Gupta) [Orabug: 39157707]
- ACPI: CPPC: Add three functions related to autonomous selection (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel() (Lifeng Zheng) [Orabug: 39157707]
- cpufreq/amd-pstate: Store the boost numerator as highest perf again (Mario Limonciello) [Orabug: 39157707]
- ACPI: CPPC: Refactor register value get and set ABIs (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Add cppc_set_reg_val() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Extract cppc_get_reg_val_in_pcc() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Optimize cppc_get_perf() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu() (Jie Zhan) [Orabug: 39157707]
- ACPI: CPPC: Clean up cppc_perf_caps and cppc_perf_ctrls structs (Sumit Gupta) [Orabug: 39157707]
- cpufreq: CPPC: Add generic helpers for sysfs show/store (Sumit Gupta) [Orabug: 39157707]
- cpufreq: CPPC: Add support for autonomous selection (Lifeng Zheng) [Orabug: 39157707]
- PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (Nirmoy Das) [Orabug: 39157707]
- PCI: Add ASPEED vendor ID to pci_ids.h (Nirmoy Das) [Orabug: 39157707]
- i2c: tegra: Add support for SW mutex register (Kartik) [Orabug: 39157707]
- i2c: tegra: Use internal reset when reset property is not available (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add HS mode support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Update Tegra256 timing parameters (Akhil R) [Orabug: 39157707]
- i2c: tegra: Use separate variables for fast and fastplus (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add Tegra264 support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add Tegra256 support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Do not configure DMA if not supported (Kartik) [Orabug: 39157707]
- gpio: tegra186: Fix GPIO name collisions for Tegra410 (Kartik) [Orabug: 39157707]
- gpio: tegra186: Use generic macro for port definitions (Kartik) [Orabug: 39157707]
- gpio: tegra186: Add support for Tegra410 (Prathamesh Shete) [Orabug: 39157707]
- gpio: tegra186: Add support for Tegra256 (Prathamesh Shete) [Orabug: 39157707]
- arm64: acpi: Enable ACPI CCEL support (Suzuki K Poulose) [Orabug: 39157707]
- arm64: Enable EFI secret area Securityfs support (Suzuki K Poulose) [Orabug: 39157707]
- arm64: realm: ioremap: Allow mapping memory as encrypted (Suzuki K Poulose) [Orabug: 39157707]
- arm64: Document Arm Confidential Compute (Steven Price) [Orabug: 39157707]
- virt: arm-cca-guest: TSM_REPORT support for realms (Sami Mujawar) [Orabug: 39157707]
- arm64: Enable memory encrypt for Realms (Suzuki K Poulose) [Orabug: 39157707]
- arm64: mm: Avoid TLBI when marking pages as valid (Steven Price) [Orabug: 39157707]
- arm64: Enforce bounce buffers for realm DMA (Steven Price) [Orabug: 39157707]
- efi: arm64: Map Device with Prot Shared (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Map unprotected MMIO as decrypted (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Add support for checking whether an MMIO is protected (Suzuki K Poulose) [Orabug: 39157707]
- arm64: realm: Query IPA size from the RMM (Steven Price) [Orabug: 39157707]
- arm64: Detect if in a realm and set RIPAS RAM (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Add RSI definitions (Suzuki K Poulose) [Orabug: 39157707]
- PCI/TPH: Add TPH documentation (Wei Huang) [Orabug: 39157707]
- PCI/TPH: Add Steering Tag support (Wei Huang) [Orabug: 39157707]
- PCI: Add TLP Processing Hints (TPH) support (Wei Huang) [Orabug: 39157707]
- sched: Update rq-&gt;avg_idle when a task is moved to an idle CPU (Shubhang Kaushik) [Orabug: 39214522]
- arm64: mte: Set TCMA1 whenever MTE is present in the kernel (Carl Worth) [Orabug: 39214522]
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov) [Orabug: 39241227,39273721] {CVE-2026-31628}
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp) [Orabug: 39252919]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp) [Orabug: 39259550]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.3.el10uek]" date="1777982400">- sched/deadline: Use revised wakeup rule for dl_server (Peter Zijlstra)
- netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [Orabug: 39339273] {CVE-2026-43084}
- netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -&gt; GFP_KERNEL_ACCOUNT allocation (Scott Mitchell)
- Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt" (Sasha Levin)
- Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads" (Sasha Levin)
- iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() (Zhen Ni) [Orabug: 39145066]
- iommu/amd: Fix header file (Vasant Hegde) [Orabug: 39145066]
- iommu/amd: Preserve default DTE fields when updating Host Page Table Root (Alejandro Jimenez) [Orabug: 39145066]
- iommu/amd: Enable support for up to 2K interrupts per function (Kishon Vijay Abraham I) [Orabug: 39145066]
- iommu/amd: Rename DTE_INTTABLEN* and MAX_IRQS_PER_TABLE macro (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Replace slab cache allocator with page allocator (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Introduce generic function to set multibit feature value (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Remove amd_iommu_apply_erratum_63() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Lock DTE before updating the entry with WRITE_ONCE() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Modify clear_dte_entry() to avoid in-place update (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce helper function get_dte256() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Modify set_dte_entry() to use 256-bit DTE helpers (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce helper function to update 256-bit DTE (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce struct ivhd_dte_flags to store persistent DTE flags (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Misc ACPI IVRS debug info clean up (Suravee Suthikulpanit) [Orabug: 39145066]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39250685,39331108] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [Orabug: 39250685]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug: 39250685,39300909] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250685]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le) [Orabug: 39250685]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug: 39250685,39283866,39291972,39292190] {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250685]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers) [Orabug: 39250685]
- iommu/arm-smmu-v3: Handle zeroed A4-2C HTTU override settings (Joao Martins) [Orabug: 39260974]</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.4.el10uek]" date="1778587200">- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39218893]  {CVE-2025-54518}
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39334587]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39334587]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39334587]
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39334587]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39334587]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39334587]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39334587]  {CVE-2026-43284}
- bcm-hsdk-gpl: Fix build issues for HSDK 6.5.34 (Vijay Kumar)  [Orabug: 39342234]
- bcm-hsdk-gpl: Update BCM HSDK GPL driver to 6.5.34 (Vijay Kumar)  [Orabug: 39342234]
- minke-fan-cpld: Avoid logging 'unknown fan id' when no fan is present (arista-hpandya)  [Orabug: 39335238]
- exadata: tools: perf: update column to comm_nodigit (Stephen Brennan)  [Orabug: 39327035]
- perf report: Add comm_nodigit sort key (Stephen Brennan)  [Orabug: 39327035]
- Revert "tools: perf: add comm_ignore_digit column" (Stephen Brennan)  [Orabug: 39327035]
- octeontx2-af: cn20k: Fix RVU AF interrupt handler (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Move QMEM allocations from GFP_KERNEL to ATOMIC (Sunil Goutham)  [Orabug: 39318904]
- bphy-pf: CNF20Ka: poll MHABs based on cpri_mask instead of fixed count (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: Add devlink param for NIX RQ caching (Nishok A)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix the RVUAF-&gt;PF mbox address (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add devlink and debugfs support for NPA DWRR registers. (Anshumali Gaur)  [Orabug: 39318904]
- cn20k-af: psw: Fix build warning (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix AI review comments. (Ratheesh Kannoth)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox to write to PSW MSIX registers (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add debugfs support for psw (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: introduce a mailbox to program PSW mbox msix vector (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add PSW AF API Notification queue support (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add FLR handler for PSW (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setup PSW timed polling structure tables (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW PCIe configuration (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW LF mapping (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add new mailbox for PSW doorbell configuration (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setups PSW FID resources (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setup PSW GID resources (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox to get PSW capabilities (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: register PSW AF interrupts (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: introduce PSW block (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: limit max periodic timers for cn20k (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Make default entries as x4. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeonxt2-af: npc: Fix bugs (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2_unregister_dl() after kernel reboot. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2vf_remove after kernel reboot. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: cn20k: Configure default CPT_AF_UCC_CTL for IPsec error codes (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: CN20k: add support for RFOE4 on half MP (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: Fix kernel crash during eswitch creation (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Use ZERO_OR_NULL_PTR for cgxchan2link_map (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add parser configuration for VLAN extraction (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support for single SBTAG parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix SDP channel base (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add MCS DSA tag parsing configuration support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Avoid any false positives for Altaf (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npc: Fix broadcast MCAM entry type on CN10K (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add platform check. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-bphy-netdev: add get_link_ksettings to fix SIOCETHTOOL error (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: dont free default mcam indexes (Ratheesh Kannoth)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Replace deprecated MSI-X API in CPRI netdev driver (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix kernel warn. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Mismatch stats. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Dont free PF default mcam indexes. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: FIx invalid access (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: dstats (Ratheesh Kannoth)  [Orabug: 39318904]
- octeonxt2-af: npc: cn20k: show enable/disable status. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: debugfs for virtual indexes (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix AI reviews (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Alloc default indexes during nix lf alloc (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix default mcam idx free (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: Remove SoC specific local variables. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix SC resource cleanup loop (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs: Add SC CAM bypass entry (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Modify the pcifunc VF mask (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: update the AFPFX_TRIGX reg offset (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: Fix rvu mbox registers offset (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2: sdp: Display backpressure status in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: add bounds check in nix_bp_enable (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: cn20k: Set a default value for res_meta_offset (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: Support mapping of individual slots to RVU block LFs (Subbaraya Sundeep)  [Orabug: 39318904]
- cn20k-af: ml: improve AF register access control (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: fetch list of LF IDs attached (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: fix using uninitialized partition ID (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable mapping LF to partition ID (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable mapping LF with partitions (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support ML lf alloc and free (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support fetching msix offset for ML (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support attach and detach of ML LFs (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: add support to fetch ML capabilities (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: implement ML mbox message handler (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: register ML interrupt handlers (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: implement hw resource setup and free (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable ML block probe and remove (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: add skeleton code for ML EB driver (Prince Takkar)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Add CN20K TX SecY policy bit support (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs: Set default mcs Id to 0. (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix memleak in npc_install flow (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix flags for HWWQE period timers (Mikko Suni)  [Orabug: 39318904]
- octeontx2-af: cn20k: Use physical address for AF-&gt;PF mbox (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: update fields of CPT_AF_LFX_CTL (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: cn20k: configure RX inline replay (Shashank Gupta)  [Orabug: 39318904]
- Octeontx2-af: cn20k: configure inline RQ mask (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Don't initialize ipsec queues for representor PF. (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-bphy-pf: CNF20ka: BPHY NIC PF driver for chiplet based BPHY NIX bypass mode (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: fix npc mbox structure defination (Mohit Kumar Parjapat)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Avoid SoC specific structures (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix get number of kw (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: cancel work before destroying wq. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx: switch: Fix compiler warnings. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: selftest: Use unique mbox ids (Linu Cherian)  [Orabug: 39318904]
- octeontx: pan: Disable WQ after unregister notifier (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Define new flag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix bugs. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Update mcam_idx for reply flow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Support ovs offloading (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Support mask as well for flow. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Pass tuple mask as well to flow. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Retrieve VLAN infor for L3 routing (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Add vlan tag as part of message (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Dont process events if switchdev is not up (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: make functions static (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix graceful shutdown. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Notify switchdev on NF table callback (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Support SNAT/DNAT routing (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Reject acceleration for invalid bridge (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Fix buffer overflow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix below kernel splat (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switchdev: Register for Route events. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switchdev: Forward route notifications. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switchdev: Add driver support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switchdev: L2 offload support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Remove devlink support for SDP VF NIC driver (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: Handle pool context address update in Aura context write (Ashwin Sekhar T K)  [Orabug: 39318904]
- octeontx2-af: CN20k: fix unused-function warning (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-pf: Move representor event handling into common file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix Rep link state sync up with PF/VFs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Fix DPC config mbox (Ashwin Sekhar T K)  [Orabug: 39318904]
- Octeontx2-pf: Fix transceiver details corruption (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: change GEN PF device ID (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20K: Fetch LBK supported channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix limiting SRIOV VF count logic (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: Fix KASAN slab-out-of-bounds error (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: Update irq affinity for mbox and flr (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add FLR/ME support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Fix possible memleak while mbox init (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Map alternative AF NIX_AF_GINT only for CN10K (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support to forward error interrupts to alt AF (Anil Kumar Reddy)  [Orabug: 39318904]
- octeontx2-af: Add support to forward flr to alternative AF (Anil Kumar Reddy)  [Orabug: 39318904]
- octeontx2-af: Update Alternative AF status (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: cn20k: Cleanup AF interrupt vector (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Do not hardcode AF bus number in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix rsrc_alloc debugfs file (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Add devlink option to reset MAC stats for debugging (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add devlink for defrag initiation (Ratheesh Kannoth)  [Orabug: 39318904]
- net: octeontx2: Fix coding style issues (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: Fix mcs string buffer size (Stefan Wiehler)  [Orabug: 39318904]
- octeontx2-af: Skip TM tree print for disabled SQs (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: debugfs: Add cn20k sdp rings info (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix kernel crash during NIX TM register dump (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: cpt: Add debug support for more than 64 engines. (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Update engine offset calculation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Add support to display "Autoneg" (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-vf: Set tc filter flag on vf netdev (Suman Ghosh)  [Orabug: 39318904]
- Octeontx2-pf: Update link mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-pf: Fix ethtool eeprom read logic (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: ethtool: Display physical connector type (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: restart interface when link settings are changed by user (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-sdpvf: Fix PTP options for SDP interfaces (Roy Franz)  [Orabug: 39318904]
- octeontx2-vf: Add partial ethtool support for SDP VFs (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Add page pool stats to ethtool (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Add missing changes in otx2_ethtool.c (Suman Ghosh)  [Orabug: 39318904]
- Octeontx2-pf: tc: fix egress ratelimiting (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Support to enable EDSA/Higig2 pkts parsing (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Using compound/head page ref count (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Fix NDC sync operation errors (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: cn20k: fix target address (Juan Garcia)  [Orabug: 39318904]
- octeontx2-pf: Check address for Null before free (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Add soft reset sequence in mcs_global_cfg() (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-pf: mcs: Don't account field alignment when installing TX SecY policy (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix start and end bit for scan config (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: npc: cn20k: Remove function (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: npc: cn20k: refactor code (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cgx: misc changes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: reset TL1 SW_XOFF before returning from link mode change (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Remove MAC address validation check (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Show count of dropped packets by DMAC filters (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Update mbox version (Sunil Goutham)  [Orabug: 39318904]
- cn10k-ipsec: Fix compilation with XFRM_OFFLOAD enabled (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-vf: Register dummy netdev for host PF VFs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Configure SQ default channel based on UP message (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Dereference only a valid pointer (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-vf: Fix VF mbox up message error on PTP RX enable (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: Add support for creating netdev interfaces for SDP VFs (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Add more debug messages (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Send UP messages to VF only when VF is up. (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Avoid null pointer dereference (Subbaraya Sundeep)  [Orabug: 39318904]
- cn10k-ipsec: fix uninitialized send queue during ESP offload (Shashank Gupta)  [Orabug: 39318904]
- cn10k-ipsec: Initialize ipsec queues on enabling IPsec (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: cn10k/cn20k: Update count_eot in NPA_LF_AURA_BATCH_FREE0 (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: persist netdev stats across routine operations (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-pf: Add self test (Linu Cherian)  [Orabug: 39318904]
- octeontx2-pf: Add ethtool -m option support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Skip dma map and unmap when IOMMU is bypassed (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-pf: Add NIXLF error/poison interrupt handlers (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-pf: Validation for TL1 Round robin priority (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: devlink param support to modify physical interface links. (Rakesh Babu)  [Orabug: 39318904]
- octeontx2-pf: Add devlink param to vary rbuf size (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Add devlink param to vary cqe size (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: CN20k: add multi chiplet support to NIX path (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Enable TX PTP timestamping on BPHY NIX link (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cn10k: Fix accessing invalid CSRs (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: fix fwdata NULL pointer dereference when RPM probe fails (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Map BPHY chiplet RPMs followed by compute chiplet RPMs (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Add chiplet RPM AF mbox support for port ready, get channel info messages. (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cnf20k: account for XCB RPM links in CGX link calculation (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Add support for chiplet based BPHY RPM driver as AF RVU extension block module (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Add BPHY chiplet, RPM, LMAC data to fwdata (Sai Krishna)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Register driver with PCI subsys ID (Anshumali Gaur)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Fix MSI-X init failure by setting both DMA masks (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20K: Add build and config support for CPRI PF driver to avoid module conflicts (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Fix CPRI MSI-X initialization failure (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Add workaround for gpint issue for CPRI pkt path (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Add cpri netdev driver support (Viswajith Murali)  [Orabug: 39318904]
- octeontx-bphy-netdev: Fix unexpected packet in netdev by ensuring proper PSW hardware write handling (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-bphy-netdev: allow forcing ts steps cnt (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix fec counters reporting (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix ecpri pkt stats update (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix ecpri type5 handling (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix a deadlock in cpri (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix race condition for timestamp packets (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix kernel crash by using proper max PSM queue count (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: protect psm queue access (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix debugfs memleak (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Detect DL circular buffer full (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix rsfec stats reading (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Support for eCPRI MsgType5 timestamping (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Use correct netdev priv structure for debugging (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: disable CPRI RX on cleanup (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: ignore mcs untagged error (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: disable rx on RFOEs on exit (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix crash issue during initialization of cpri, rfoe interfaces on set MAC address (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: OcteonTX2 Base PHY RFOE netdev driver (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver msix, interrupt handling (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Move DPI block reset handling to AF extension block driver (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver channel table mbox support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver mbox support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver initial support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cn20k: Don't reset the PF_DISC register (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: CN20K: update RPM links (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add block discovery register (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix PTP RX enable mbox fail issue over NIC VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Modify NIX register offset value for CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Validate NIX maximum LFs correctly (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix incorrect BPID initialization for CPT channels (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow CPT PF access to CPT_AF_GRPX_THR (Shashank Gupta)  [Orabug: 39318904]
- octeontx2-af: cn20k: support packet data buffer (pdb) configuration (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Set LBK channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix config parameter check when disable inline queue (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable CPT parse and Frag info header byte swap (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Add an MCAM entry to count CPT 2nd pass miss packets (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: support overriding aura to zero for second pass (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Use proper mask to get max CPT LF's (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: allow mbox access from CPT VFs for backward compatibility (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: Drop CPT PF/VF check for relevant mboxes (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Change CPT channels configuration (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow CPT PF access to CPTX_AF_CTX_PSP_TIMER_CTL (Shashank Gupta)  [Orabug: 39318904]
- octeontx2-af: cn20k: change CPT register address as per latest csr (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow access to CPT_AF_UCCX_CTL (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: CN20K channel configuration (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable RXC on inline inbound cptlf (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix RXC flush and cleanup sequence (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add CPT CTX flush support (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: fix CPT ctx flush (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: cn20k: Setup CPT reassembly Queue Configuration Register (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Move RXC specific functions (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: cn20k: handle multi-queue reassembly teardown (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for NIX RX inline configuration (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for CPT RX inline configuration (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for CPT RX queue allocation (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mbox to configure rx inline nixlf (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mbox to configure rx inline profile (Bharat Bhushan)  [Orabug: 39318904]
- crypto: octeontx2: Add new mailbox to set queue priority (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add rxc teardown support (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add queue id to rxc time config mbox (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add cpt stats mailbox support (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: add FLT interrupts (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: Unify HW interrupt APIs (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx-af: cpt: Get CPT PF number using PF Device ID (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Update max engine calculation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Add TC rules support for CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Set correct sequence for carrier off and tx queue stop (Suman Ghosh)  [Orabug: 39318904]
- octeontx2: Fix klockwork issues. (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Free queue memory allocated sq timestamp (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Check for DMAC extraction support before setting DMAC based hardware filter for a VF (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Move REP devlink APIs to separate file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix representor up notification events (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Use ews_rules value to update REP tcam rules (Geetha sowjanya)  [Orabug: 39318904]
- Octeontx2-af: Change args for rvu_get_pf (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add validation before accessing fwdata (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: map management port always to first PF (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: replace generic error codes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: link mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Assign CGX id from PCI revision id (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Remove MAC address validation check (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: lmac validation with is_lmac_valid (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix compilation warning/klockwork issues (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: configure 802.3 pause frames in SGMII/QSGMII mode (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add new CGX_CMDs to set and get PHY modulation type (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Do not allow VFs to overwrite PKIND config (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Put CGX LMAC also in Higig2 mode (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-sdp: Add FLR interrupts for Host PFs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Refactor SDP interrupts code (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Fix SDP channel numbers in NPC rules (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Check whether SDP block is present before access (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: sdp: Fix address range assignment logic (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: sdp: Maintain host to RVU GEN PF mapping (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: misc SDP fixes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx-af: cn20k: Manage rings allocation and freeing (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: CN20K: SDP mbox framework (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: CN20K: SDP extension driver (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-pf: enable AF_XDP zero copy support (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix clearing TL3_TL2X_LINKX_CFG[ENA] during SMQ flush to drop packets (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Fix ROCEV2 RSS hashing QP ID length (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Allow to set CPT result address offset (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for NIX flow vector configuration (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: add ROCEv2 header for RSS hashing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Update lbk maximum frame size as per CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: fix TX scheduler count (Satha Rao)  [Orabug: 39318904]
- octeontx2-af: Fix the issue of infinite loop in nix_aq_reset (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Misc changes in NIX block (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Dump hw register state on error (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add new mailbox to configure LSO alt flags (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Extend SPI to SA index translation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: notify VF about ptp event (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: Sending tsc value to the userspace (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: Support for PTP notification to PF (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: npa: fix DPC permit register access (Ashwin Sekhar T K)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add DPC support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add debugfs support for Halo (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add NPA Halo support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Fix number of entries in the kpu3 cam (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix subbank count (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix number of entries in the kpu2 cam (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add mbox to read default rule (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: kpu: Input validation check. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: kpu: Fix lodable profile issue (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Convert to C99 flexible array (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Restore stats in defrag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Flow delete and free mbox (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Add traces in NPC mailboxes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix KPU9 state variable for ROCEV2 (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add support for ROCEv2 header parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add more VLAN tag parsing in case of E-tag (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flags for cn20k (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Avoid updating cn10k registers during cn20k reboot (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Do not access match stats for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: Update NPC CSRs (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix out of bound access in entry2counter array (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix initialization of mcam's entry2target_pffunc field (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flag extraction in parse nibble (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix CPT CGX channel mask for cn20k (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flag in KPU profile for CN20K (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: fix mcam hit counter (Satheesh Paul)  [Orabug: 39318904]
- Revert "octeontx2-af: npc: cn20k: Get base steer rule index." (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: fix rule type for LBK VF (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: Fix failed to load custom pfl warning (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: add changes to update CPT pad length offset in KPU (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix search order (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: Use dev_dbg() (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix compilation warnings (Sunil Goutham)  [Orabug: 39318904]
- octeontx2: cn20k: npc: Set action2 for x2 entries. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable action2 programming in npc (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Set default profile DYNAMIC (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix csr register field offset. (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Reject request for x4 entries in x2 profile. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Alloc mcam entry for install flow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Disable fw load faiure warning (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Load custom kpu profile from filesystem. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix install flow priority (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add support for custom mkex profiles (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Get base steer rule index. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Stats support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cn20k: Reject mcam alloc mbox with invalid keytype (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Reserve x4 key mcam entries for ntuple (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Get kex related info from PF. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix parse result nibble mask reading. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Set correct nibble bits for cn20k (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix parse nibble mask (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Avoid accessing cn10k registers (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add new mailboxes for CN20K silicon (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix npc_mcam_get_hit_status mbox for cn10k (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Convert vidx to mcam_idx in mbox handler (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add an mbox interface to defrag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: defragmentation support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Introduce virtual mcam index (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Validate mcam index before enable/disable (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add new mailboxes to get kex config and free counts (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Use common APIs to read/write/copy/enable mcam entry (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Add a new mbox to read/write MCAM hit status (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: debugfs support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Use common APIs to alloc/free/get mcam index. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Allocate default mcam indexes. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Modify alloc entry mailbox (Suman Ghosh)  [Orabug: 39318904]
- ocetontx2-af: npc: cn20k: MKEX profile support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: KPM profile changes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Index management. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: Fix klockwork issues. (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix Support of FDSA tag (George Cherian)  [Orabug: 39318904]
- octeontx2-af: Support for FDSA tag (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Adding changes to parse stacked VLANs (Kiran Kumar K)  [Orabug: 39318904]
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix issue with GRE parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add support to parse more VLAN headers (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix issue with IPV6 GRE and multi VLAN (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add KPU changes to parse fabric path header (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add few missing changes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: allow second pass pkts via default ucast entry (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: suppress kpu profile loading warning (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: use cpt channel mask in flow install path (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: Add NPC support to filter GTP-U and GTP-C packets based on TEID (Suman Ghosh)  [Orabug: 39318904]
- octeontx2: cn20k: Assign unique MCS IDs based on PCI enumeration (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-pf: Choose macsec encryption offload per packet (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: mcs: Use new SCI CAM in hardware (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: mcs: Fix mcs resources free on PF shutdown (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Add devlink parameter to toggle MCS bypass mode (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Display port mapped stats for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add MCS LMAC channel and count configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs set mcs id and silicon check (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix mcs tx_sa_map API (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mcs PN threshold support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: MCS add port configure APIs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: Add MCS parser configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix mcs register offsets (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix unsupported secy stats read (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add MCS support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: mcs: Remove SA stats support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cnf10k-b: mcs: Fix stats reg address (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: rvu: enable mcs fips mailboxes (Ankur Dwivedi)  [Orabug: 39318904]
- octeontx2-af: mcs: add mailboxes for fips (Ankur Dwivedi)  [Orabug: 39318904]
- octeontx2-af: sso: clear all the sets on init (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: tim: add ring priority support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: update TIM interval support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: moderate SSO AF error interrupts (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: lower TIM bucket skip IRQ log level (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: remove GTI clock adjustment (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: update xaq aura offset (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: cleanup SSO EVA on LF reset (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO HW info mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO AGGR config and stats mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO EVA error interrupts (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: update masks for CN20K resources (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: Fixed compilation warnings (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: fix interval flag check (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add TIM hardware info mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add TIM HWWQE mbox support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add mbox to capture counters (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: reveal only TIM params that are available (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: add TIM error af interrupt handlers (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: clear state on TIM ring disable (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: disable preemption when enabling TIM (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: account for cycle wraparound (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: prevent TIM register read reorder (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: fix arguments passed to XAQ aura deinit (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: debugfs: fix undefined SSO register access (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: update TIM adjust GTI errata silicons (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: update TIM adjust GTI errata silicons (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: add TIM adjust GTI errata workaround (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: cn10k: devlink params to configure TIM (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: TIM: Set conditional clock always on (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Apply relevant HW issue workarounds for 96xx B0 silicon (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: Add SSO and TIM units support to the AF driver (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: enable rxc with lookaside cpt lf (Vidya Sagar Velumuri)  [Orabug: 39318904]
- octeontx2-af: fix issue with spitosa table teardown (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: fix cflags include paths (Wladislav Wiebe)  [Orabug: 39318904]
- octeontx2-af: Move out REE mbox messages (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add generic mbox handler for Eblock (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Use AF extension block interface (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add RVU AF extension block interface (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Introducing REE block for 98xx (Smadar Fuks)  [Orabug: 39318904]
- octeontx2-af: fix VF bringup affecting PF promiscous state (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: consider mode when using cpt base channel for bp (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: Update minimum receive frame size (Sathesh Edara)  [Orabug: 39318904]
- octeontx2-af: set default min and max rx len for CPT link (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: add NIX mbox message to get HW info (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: fix inline inbound IPsec configuration (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: support for custom L2 header (Satheesh Paul A)  [Orabug: 39318904]
- octeontx2-af: fix to get different rq mask (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: poll for tx link credits before link mode change (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Handle physical link state change requests (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add mbox to alloc/free BPIDs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Dynamically allocate bpids for CPT and LBK (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support for SPI to SA index translation (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Update HW workarounds for 96xx C0, 98xx and F95xx B0 chips (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add devlink support to configure TL1 RR_PRIO (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: add support for CPT second pass (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: add new mbox to support sync cycle on rx path (Satha Rao)  [Orabug: 39318904]
- octeontx2-af: add support for changing vlan tpid (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-pf: Fix devm_kcalloc() error checking (Dan Carpenter)  [Orabug: 39318904]
- octeontx2-pf: Use new bandwidth profiles in receive queue (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Display new bandwidth profiles too in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Accommodate more bandwidth profiles for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Initialize new NIX SQ context for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Initialize cn20k specific aura and pool contexts (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Skip NDC operations for cn20k (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Extend debugfs support for cn20k NPA (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add cn20k NPA block contexts (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Extend debugfs support for cn20k NIX (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Add cn20k NIX block contexts (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Simplify context writing and reading to hardware (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: convert to ndo_hwtstamp API (Vadim Fedorenko)  [Orabug: 39318904]
- Octeontx2-af: Fix pci_alloc_irq_vectors() return value check (Harshit Mogalapalli)  [Orabug: 39318904]
- Octeontx2-af: Fix missing error code in cgx_probe() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-pf: fix bitmap leak (Bo Sun)  [Orabug: 39318904]
- octeontx2-vf: fix bitmap leak (Bo Sun)  [Orabug: 39318904]
- octeontx2-af: Remove unused declarations (Yue Haibing)  [Orabug: 39318904]
- Octeontx2-af: Fix NIX X2P calibration failures (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-vf: Fix max packet length errors (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Broadcast XON on all channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: use unsigned int as iterator for unsigned values (Simon Horman)  [Orabug: 39318904]
- net: Fix typos (Bjorn Helgaas)  [Orabug: 39318904]
- Octeontx2-af: Debugfs support for firmware data (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: RPM: Update DMA mask (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Disable stale DMAC filters (Subbaraya Sundeep)  [Orabug: 39318904]
- Octeontx2-af: Add programmed macaddr to RVU pfvf (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix error code in rvu_mbox_init() (Dan Carpenter)  [Orabug: 39318904]
- Octeontx2-pf: ethtool: support multi advertise mode (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Introduce mode group index (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx-pf: Update SGMII mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix rvu_mbox_init return path (Subbaraya Sundeep)  [Orabug: 39318904]
- Octeontx2-pf: Fix Backpresure configuration (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: CN20K mbox implementation between PF-VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20K mbox implementation for AF's VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: CN20K mbox REQ/ACK implementation for NIC PF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k mbox to support AF REQ/ACK functionality (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k basic mbox operations and structures (Sai Krishna)  [Orabug: 39318904]
- octeontx2: Set appropriate PF, VF masks and shifts based on silicon (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Avoid typecasts by simplifying otx2_atomic64_add macro (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Annotate mmio regions as __iomem (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: macsec: Get MACSEC capability flag from AF (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Add MACSEC capability flag (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Send Link events one by one (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: NPC: Clear Unicast rule on nixlf detach (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Avoid adding dcbnl_ops for LBK and SDP vf (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Add tracepoint for NIX_PARSE_S (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Add new tracepoint otx2_msg_status (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Add pcifunc also to mailbox tracepoints (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Display names for CPT and UP messages (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: convert dev_dbg to tracepoint in mbox (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Fix ethtool support for SDP representors (Hariprasad Kelam)  [Orabug: 39318904]
- net: octeontx2: Use pure PCI devres API (Philipp Stanner)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP: code clean up (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Remove unused rvu_npc_enable_bcast_entry (Dr. David Alan Gilbert)  [Orabug: 39318904]
- xfrm: Add explicit dev to .xdo_dev_state_{add,delete,free} (Cosmin Ratiu)  [Orabug: 39318904]
- octeontx2-pf: handle otx2_mbox_get_rsp errors (Chenyuan Yang)  [Orabug: 39318904]
- net: octeontx2: Handle XDP_ABORTED and XDP invalid as XDP_DROP (Lorenzo Bianconi)  [Orabug: 39318904]
- octeontx2-af: mcs: Remove redundant 'flush_workqueue()' calls (Chen Ni)  [Orabug: 39318904]
- net: octeontx2: Add metadata support for xdp mode (Lorenzo Bianconi)  [Orabug: 39318904]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 39318904]
- octeontx2: hide unused label (Arnd Bergmann)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP zero copy transmit support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Prepare for AF_XDP (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Reconfigure RSS table after enabling AF_XDP zerocopy on rx queue (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP zero copy receive support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: use xdp_return_frame() to free xdp buffers (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: mcs: Remove dead code and semi-colon from rsrc_name() (Nihar Chaithanya)  [Orabug: 39318904]
- octeontx2-pf: fix error handling of devlink port in rvu_rep_create() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-pf: fix netdev memory leak in rvu_rep_create() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-af: fix build regression without CONFIG_DCB (Arnd Bergmann)  [Orabug: 39318904]
- cn10k-ipsec: Fix compilation error when CONFIG_XFRM_OFFLOAD disabled (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Fix installation of PF multicast rule (Geetha sowjanya)  [Orabug: 39318904]
- cn10k-ipsec: Enable outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Allow ipsec crypto offload for skb with SA (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Process outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Add SA add/del support for outb ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Init hardware for outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Disable backpressure between CPT and NIX (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Move skb fragment map/unmap to common code (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: map skb data as device writeable (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Fix SDP MAC link credits configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Fix spelling mistake "reprentator" -&gt; "representor" (Colin Ian King)  [Orabug: 39318904]
- octeontx2-pf: Adds TC offload support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Implement offload stats ndo for representors (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add devlink port support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add representors for sdp MAC (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Configure VF mtu via representor (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add support to sync link state between representor and VFs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Get VF stats via representor (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add packet path between representor and VF (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add basic net_device_ops (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Create representor netdev (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: RVU representor driver (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Knobs for NPC default rule counters (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Refactor few NPC mcam APIs (Linu Cherian)  [Orabug: 39318904]
- octeontx2-pf: Move shared APIs to header file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Reuse PF max mtu value (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add new APIs for queue memory alloc/free. (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Define common API for HW resources configuration (Geetha sowjanya)  [Orabug: 39318904]
- net: marvell: use ethtool string helpers (Rosen Penev)  [Orabug: 39318904]
- uek: kabi: update kABI files for new symbols (Saeed Mirzamohammadi)  [Orabug: 39268116]
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39167615]  {CVE-2026-31402}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39110670]  {CVE-2026-23278}
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39103229]  {CVE-2026-23270}</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.5.el10uek]" date="1779192000">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39407652]  {CVE-2026-46333}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.6.el10uek]" date="1779796800">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39442660]  {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39442660]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.7.el10uek]" date="1779969600">- tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi)  [Orabug: 39456024]
- tap: free page on error paths in tap_get_user_xdp() (Weiming Shi)  [Orabug: 39456024]
- tun: free page on short-frame rejection in tun_xdp_one() (Weiming Shi)  [Orabug: 39456024]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.7.1.el10uek]" date="1780315200">- smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39474418]</changelog>
</package>
<package pkgid="36e00df17f319ab2cc4ac5e1fdd8ccbdb19d8860" name="kernel-uek" arch="src">
  <version epoch="0" ver="6.12.0" rel="203.76.7.1.el10uek"/>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) [Orabug: 39227772] {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) [Orabug: 39251164] {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) [Orabug: 39251169] {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) [Orabug: 39262447] {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) [Orabug: 39331678] {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) [Orabug: 39331784] {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) [Orabug: 39300554] {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) [Orabug: 39331889] {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) [Orabug: 39331303] {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) [Orabug: 39331577] {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) [Orabug: 39339241] {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) [Orabug: 39343623] {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) [Orabug: 39331924] {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) [Orabug: 39331696] {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) [Orabug: 39331680] {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) [Orabug: 39331661] {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) [Orabug: 39331512] {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) [Orabug: 39331937] {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) [Orabug: 39331435] {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) [Orabug: 39331422] {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) [Orabug: 39343538] {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) [Orabug: 39331504] {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) [Orabug: 39331827] {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) [Orabug: 39343546] {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) [Orabug: 39331482] {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) [Orabug: 39331693] {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) [Orabug: 39331458] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) [Orabug: 39331580] {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) [Orabug: 39331409] {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) [Orabug: 39331341] {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) [Orabug: 39331444] {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) [Orabug: 39331510] {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) [Orabug: 39331358] {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) [Orabug: 39331954] {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) [Orabug: 39331545] {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) [Orabug: 39331821] {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) [Orabug: 39331705] {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) [Orabug: 39331366] {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) [Orabug: 39331866] {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) [Orabug: 39331752] {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) [Orabug: 39331370] {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) [Orabug: 39331846] {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) [Orabug: 39331389] {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) [Orabug: 39331440] {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) [Orabug: 39343613] {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) [Orabug: 39331353] {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) [Orabug: 39331023] {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) [Orabug: 39331012] {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) [Orabug: 39331761] {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) [Orabug: 39331606] {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) [Orabug: 39331628] {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) [Orabug: 39331331] {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) [Orabug: 39331449] {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) [Orabug: 39331361] {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) [Orabug: 39331875] {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) [Orabug: 39331549] {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) [Orabug: 39331496] {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) [Orabug: 39331383] {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) [Orabug: 39331959] {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) [Orabug: 39343626] {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [Orabug: 39343577] {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) [Orabug: 39331591] {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) [Orabug: 39343531] {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) [Orabug: 39331853] {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) [Orabug: 39331859] {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) [Orabug: 39343609] {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) [Orabug: 39331003] {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) [Orabug: 39343515] {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) [Orabug: 39331318] {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) [Orabug: 39331375] {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) [Orabug: 39343527] {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) [Orabug: 39331585] {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) [Orabug: 39343616] {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) [Orabug: 39331719] {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) [Orabug: 39331807] {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) [Orabug: 39343628] {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) [Orabug: 39331070] {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) [Orabug: 39331308] {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) [Orabug: 39343581] {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) [Orabug: 39331918] {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) [Orabug: 39343603] {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) [Orabug: 39331896] {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) [Orabug: 39331636] {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) [Orabug: 39331947] {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) [Orabug: 39331518] {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) [Orabug: 39331877] {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) [Orabug: 39331789] {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) [Orabug: 39331882] {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) [Orabug: 39331312] {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) [Orabug: 39331077] {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 38649060,39186444,39202432] {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet) [Orabug: 38887740,39181101,39202431] {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera) [Orabug: 39029337,39131054] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe) [Orabug: 39144150,39343763] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao) [Orabug: 38970584,39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A) [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu) [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu) [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu) [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu) [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu) [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski) [Orabug: 39166116]</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.1.el10uek]" date="1776772800">- Revert "EDAC: Octeon: Init SDEI" (Jeremy Tang) [Orabug: 39203407]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.2.el10uek]" date="1777464000">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman) [Orabug: 39276980]
- uek-rpm/config-aarch64: Enable NVIDIA-recommended Vera-Rubin configs (Vijay Kumar) [Orabug: 39157707]
- kselftest/arm64: Add HWCAP test for FEAT_LS64 (Yicong Yang) [Orabug: 39157707]
- arm64: Provide basic EL2 setup for FEAT_{LS64, LS64_V} usage at EL0/1 (Yicong Yang) [Orabug: 39157707]
- perf: arm_spe: Relax period restriction (Leo Yan) [Orabug: 39157707]
- perf/arm_cspmu: Add PMEVFILT2R support (Robin Murphy) [Orabug: 39157707]
- ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional (Lifeng Zheng) [Orabug: 39157707]
- dt-bindings: gpio: Add Tegra256 support (Prathamesh Shete) [Orabug: 39157707]
- perf/arm_cspmu: nvidia: Add revision id matching (Besar Wicaksono) [Orabug: 39157707]
- arm64: Handle BRBE booting requirements (Anshuman Khandual) [Orabug: 39157707]
- arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again (Rob Herring) [Orabug: 39157707]
- arm64/gcs: Provide basic EL2 setup to allow GCS usage at EL0 and EL1 (Mark Brown) [Orabug: 39157707]
- tools headers arm64: Add NVIDIA Olympus part (Besar Wicaksono) [Orabug: 39157707]
- perf arm-spe: Add NVIDIA Olympus to neoverse list (Besar Wicaksono) [Orabug: 39157707]
- perf arm_spe: Add CPU variants supporting common data source packet (Leo Yan) [Orabug: 39157707]
- arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Yicong Yang) [Orabug: 39157707]
- perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Yicong Yang) [Orabug: 39157707]
- perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions (Yicong Yang) [Orabug: 39157707]
- perf/arm_cspmu: nvidia: Add pmevfiltr2 support (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Add pmpidr support (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Move register definitons to header (Robin Murphy) [Orabug: 39157707]
- perf/arm_cspmu: Add callback to reset filter config (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Generalise event filtering (Robin Murphy) [Orabug: 39157707]
- perf: arm_pmuv3: Add support for the Branch Record Buffer Extension (BRBE) (Rob Herring) [Orabug: 39157707]
- arm64/sysreg: Add BRBE registers and fields (Anshuman Khandual) [Orabug: 39157707]
- perf: arm_pmu: Move PMUv3-specific data (Mark Rutland) [Orabug: 39157707]
- perf: apple_m1: Don't disable counter in m1_pmu_enable_event() (Rob Herring) [Orabug: 39157707]
- perf: arm_v7_pmu: Don't disable counter in (armv7|krait_|scorpion_)pmu_enable_event() (Rob Herring) [Orabug: 39157707]
- perf: arm_v7_pmu: Drop obvious comments for enabling/disabling counters and interrupts (Rob Herring) [Orabug: 39157707]
- perf: arm_pmuv3: Don't disable counter in armv8pmu_enable_event() (Mark Rutland) [Orabug: 39157707]
- ACPI: CPPC: Rename EPP constants for clarity (Sumit Gupta) [Orabug: 39157707]
- ACPI: CPPC: Add three functions related to autonomous selection (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel() (Lifeng Zheng) [Orabug: 39157707]
- cpufreq/amd-pstate: Store the boost numerator as highest perf again (Mario Limonciello) [Orabug: 39157707]
- ACPI: CPPC: Refactor register value get and set ABIs (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Add cppc_set_reg_val() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Extract cppc_get_reg_val_in_pcc() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Optimize cppc_get_perf() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu() (Jie Zhan) [Orabug: 39157707]
- ACPI: CPPC: Clean up cppc_perf_caps and cppc_perf_ctrls structs (Sumit Gupta) [Orabug: 39157707]
- cpufreq: CPPC: Add generic helpers for sysfs show/store (Sumit Gupta) [Orabug: 39157707]
- cpufreq: CPPC: Add support for autonomous selection (Lifeng Zheng) [Orabug: 39157707]
- PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (Nirmoy Das) [Orabug: 39157707]
- PCI: Add ASPEED vendor ID to pci_ids.h (Nirmoy Das) [Orabug: 39157707]
- i2c: tegra: Add support for SW mutex register (Kartik) [Orabug: 39157707]
- i2c: tegra: Use internal reset when reset property is not available (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add HS mode support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Update Tegra256 timing parameters (Akhil R) [Orabug: 39157707]
- i2c: tegra: Use separate variables for fast and fastplus (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add Tegra264 support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add Tegra256 support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Do not configure DMA if not supported (Kartik) [Orabug: 39157707]
- gpio: tegra186: Fix GPIO name collisions for Tegra410 (Kartik) [Orabug: 39157707]
- gpio: tegra186: Use generic macro for port definitions (Kartik) [Orabug: 39157707]
- gpio: tegra186: Add support for Tegra410 (Prathamesh Shete) [Orabug: 39157707]
- gpio: tegra186: Add support for Tegra256 (Prathamesh Shete) [Orabug: 39157707]
- arm64: acpi: Enable ACPI CCEL support (Suzuki K Poulose) [Orabug: 39157707]
- arm64: Enable EFI secret area Securityfs support (Suzuki K Poulose) [Orabug: 39157707]
- arm64: realm: ioremap: Allow mapping memory as encrypted (Suzuki K Poulose) [Orabug: 39157707]
- arm64: Document Arm Confidential Compute (Steven Price) [Orabug: 39157707]
- virt: arm-cca-guest: TSM_REPORT support for realms (Sami Mujawar) [Orabug: 39157707]
- arm64: Enable memory encrypt for Realms (Suzuki K Poulose) [Orabug: 39157707]
- arm64: mm: Avoid TLBI when marking pages as valid (Steven Price) [Orabug: 39157707]
- arm64: Enforce bounce buffers for realm DMA (Steven Price) [Orabug: 39157707]
- efi: arm64: Map Device with Prot Shared (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Map unprotected MMIO as decrypted (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Add support for checking whether an MMIO is protected (Suzuki K Poulose) [Orabug: 39157707]
- arm64: realm: Query IPA size from the RMM (Steven Price) [Orabug: 39157707]
- arm64: Detect if in a realm and set RIPAS RAM (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Add RSI definitions (Suzuki K Poulose) [Orabug: 39157707]
- PCI/TPH: Add TPH documentation (Wei Huang) [Orabug: 39157707]
- PCI/TPH: Add Steering Tag support (Wei Huang) [Orabug: 39157707]
- PCI: Add TLP Processing Hints (TPH) support (Wei Huang) [Orabug: 39157707]
- sched: Update rq-&gt;avg_idle when a task is moved to an idle CPU (Shubhang Kaushik) [Orabug: 39214522]
- arm64: mte: Set TCMA1 whenever MTE is present in the kernel (Carl Worth) [Orabug: 39214522]
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov) [Orabug: 39241227,39273721] {CVE-2026-31628}
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp) [Orabug: 39252919]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp) [Orabug: 39259550]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.3.el10uek]" date="1777982400">- sched/deadline: Use revised wakeup rule for dl_server (Peter Zijlstra)
- netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [Orabug: 39339273] {CVE-2026-43084}
- netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -&gt; GFP_KERNEL_ACCOUNT allocation (Scott Mitchell)
- Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt" (Sasha Levin)
- Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads" (Sasha Levin)
- iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() (Zhen Ni) [Orabug: 39145066]
- iommu/amd: Fix header file (Vasant Hegde) [Orabug: 39145066]
- iommu/amd: Preserve default DTE fields when updating Host Page Table Root (Alejandro Jimenez) [Orabug: 39145066]
- iommu/amd: Enable support for up to 2K interrupts per function (Kishon Vijay Abraham I) [Orabug: 39145066]
- iommu/amd: Rename DTE_INTTABLEN* and MAX_IRQS_PER_TABLE macro (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Replace slab cache allocator with page allocator (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Introduce generic function to set multibit feature value (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Remove amd_iommu_apply_erratum_63() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Lock DTE before updating the entry with WRITE_ONCE() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Modify clear_dte_entry() to avoid in-place update (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce helper function get_dte256() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Modify set_dte_entry() to use 256-bit DTE helpers (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce helper function to update 256-bit DTE (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce struct ivhd_dte_flags to store persistent DTE flags (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Misc ACPI IVRS debug info clean up (Suravee Suthikulpanit) [Orabug: 39145066]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39250685,39331108] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [Orabug: 39250685]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug: 39250685,39300909] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250685]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le) [Orabug: 39250685]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug: 39250685,39283866,39291972,39292190] {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250685]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers) [Orabug: 39250685]
- iommu/arm-smmu-v3: Handle zeroed A4-2C HTTU override settings (Joao Martins) [Orabug: 39260974]</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.4.el10uek]" date="1778587200">- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39218893]  {CVE-2025-54518}
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39334587]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39334587]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39334587]
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39334587]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39334587]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39334587]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39334587]  {CVE-2026-43284}
- bcm-hsdk-gpl: Fix build issues for HSDK 6.5.34 (Vijay Kumar)  [Orabug: 39342234]
- bcm-hsdk-gpl: Update BCM HSDK GPL driver to 6.5.34 (Vijay Kumar)  [Orabug: 39342234]
- minke-fan-cpld: Avoid logging 'unknown fan id' when no fan is present (arista-hpandya)  [Orabug: 39335238]
- exadata: tools: perf: update column to comm_nodigit (Stephen Brennan)  [Orabug: 39327035]
- perf report: Add comm_nodigit sort key (Stephen Brennan)  [Orabug: 39327035]
- Revert "tools: perf: add comm_ignore_digit column" (Stephen Brennan)  [Orabug: 39327035]
- octeontx2-af: cn20k: Fix RVU AF interrupt handler (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Move QMEM allocations from GFP_KERNEL to ATOMIC (Sunil Goutham)  [Orabug: 39318904]
- bphy-pf: CNF20Ka: poll MHABs based on cpri_mask instead of fixed count (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: Add devlink param for NIX RQ caching (Nishok A)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix the RVUAF-&gt;PF mbox address (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add devlink and debugfs support for NPA DWRR registers. (Anshumali Gaur)  [Orabug: 39318904]
- cn20k-af: psw: Fix build warning (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix AI review comments. (Ratheesh Kannoth)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox to write to PSW MSIX registers (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add debugfs support for psw (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: introduce a mailbox to program PSW mbox msix vector (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add PSW AF API Notification queue support (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add FLR handler for PSW (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setup PSW timed polling structure tables (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW PCIe configuration (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW LF mapping (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add new mailbox for PSW doorbell configuration (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setups PSW FID resources (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setup PSW GID resources (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox to get PSW capabilities (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: register PSW AF interrupts (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: introduce PSW block (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: limit max periodic timers for cn20k (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Make default entries as x4. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeonxt2-af: npc: Fix bugs (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2_unregister_dl() after kernel reboot. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2vf_remove after kernel reboot. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: cn20k: Configure default CPT_AF_UCC_CTL for IPsec error codes (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: CN20k: add support for RFOE4 on half MP (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: Fix kernel crash during eswitch creation (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Use ZERO_OR_NULL_PTR for cgxchan2link_map (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add parser configuration for VLAN extraction (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support for single SBTAG parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix SDP channel base (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add MCS DSA tag parsing configuration support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Avoid any false positives for Altaf (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npc: Fix broadcast MCAM entry type on CN10K (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add platform check. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-bphy-netdev: add get_link_ksettings to fix SIOCETHTOOL error (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: dont free default mcam indexes (Ratheesh Kannoth)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Replace deprecated MSI-X API in CPRI netdev driver (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix kernel warn. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Mismatch stats. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Dont free PF default mcam indexes. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: FIx invalid access (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: dstats (Ratheesh Kannoth)  [Orabug: 39318904]
- octeonxt2-af: npc: cn20k: show enable/disable status. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: debugfs for virtual indexes (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix AI reviews (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Alloc default indexes during nix lf alloc (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix default mcam idx free (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: Remove SoC specific local variables. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix SC resource cleanup loop (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs: Add SC CAM bypass entry (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Modify the pcifunc VF mask (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: update the AFPFX_TRIGX reg offset (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: Fix rvu mbox registers offset (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2: sdp: Display backpressure status in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: add bounds check in nix_bp_enable (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: cn20k: Set a default value for res_meta_offset (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: Support mapping of individual slots to RVU block LFs (Subbaraya Sundeep)  [Orabug: 39318904]
- cn20k-af: ml: improve AF register access control (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: fetch list of LF IDs attached (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: fix using uninitialized partition ID (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable mapping LF to partition ID (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable mapping LF with partitions (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support ML lf alloc and free (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support fetching msix offset for ML (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support attach and detach of ML LFs (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: add support to fetch ML capabilities (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: implement ML mbox message handler (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: register ML interrupt handlers (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: implement hw resource setup and free (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable ML block probe and remove (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: add skeleton code for ML EB driver (Prince Takkar)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Add CN20K TX SecY policy bit support (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs: Set default mcs Id to 0. (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix memleak in npc_install flow (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix flags for HWWQE period timers (Mikko Suni)  [Orabug: 39318904]
- octeontx2-af: cn20k: Use physical address for AF-&gt;PF mbox (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: update fields of CPT_AF_LFX_CTL (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: cn20k: configure RX inline replay (Shashank Gupta)  [Orabug: 39318904]
- Octeontx2-af: cn20k: configure inline RQ mask (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Don't initialize ipsec queues for representor PF. (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-bphy-pf: CNF20ka: BPHY NIC PF driver for chiplet based BPHY NIX bypass mode (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: fix npc mbox structure defination (Mohit Kumar Parjapat)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Avoid SoC specific structures (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix get number of kw (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: cancel work before destroying wq. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx: switch: Fix compiler warnings. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: selftest: Use unique mbox ids (Linu Cherian)  [Orabug: 39318904]
- octeontx: pan: Disable WQ after unregister notifier (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Define new flag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix bugs. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Update mcam_idx for reply flow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Support ovs offloading (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Support mask as well for flow. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Pass tuple mask as well to flow. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Retrieve VLAN infor for L3 routing (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Add vlan tag as part of message (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Dont process events if switchdev is not up (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: make functions static (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix graceful shutdown. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Notify switchdev on NF table callback (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Support SNAT/DNAT routing (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Reject acceleration for invalid bridge (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Fix buffer overflow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix below kernel splat (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switchdev: Register for Route events. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switchdev: Forward route notifications. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switchdev: Add driver support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switchdev: L2 offload support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Remove devlink support for SDP VF NIC driver (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: Handle pool context address update in Aura context write (Ashwin Sekhar T K)  [Orabug: 39318904]
- octeontx2-af: CN20k: fix unused-function warning (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-pf: Move representor event handling into common file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix Rep link state sync up with PF/VFs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Fix DPC config mbox (Ashwin Sekhar T K)  [Orabug: 39318904]
- Octeontx2-pf: Fix transceiver details corruption (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: change GEN PF device ID (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20K: Fetch LBK supported channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix limiting SRIOV VF count logic (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: Fix KASAN slab-out-of-bounds error (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: Update irq affinity for mbox and flr (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add FLR/ME support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Fix possible memleak while mbox init (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Map alternative AF NIX_AF_GINT only for CN10K (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support to forward error interrupts to alt AF (Anil Kumar Reddy)  [Orabug: 39318904]
- octeontx2-af: Add support to forward flr to alternative AF (Anil Kumar Reddy)  [Orabug: 39318904]
- octeontx2-af: Update Alternative AF status (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: cn20k: Cleanup AF interrupt vector (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Do not hardcode AF bus number in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix rsrc_alloc debugfs file (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Add devlink option to reset MAC stats for debugging (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add devlink for defrag initiation (Ratheesh Kannoth)  [Orabug: 39318904]
- net: octeontx2: Fix coding style issues (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: Fix mcs string buffer size (Stefan Wiehler)  [Orabug: 39318904]
- octeontx2-af: Skip TM tree print for disabled SQs (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: debugfs: Add cn20k sdp rings info (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix kernel crash during NIX TM register dump (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: cpt: Add debug support for more than 64 engines. (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Update engine offset calculation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Add support to display "Autoneg" (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-vf: Set tc filter flag on vf netdev (Suman Ghosh)  [Orabug: 39318904]
- Octeontx2-pf: Update link mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-pf: Fix ethtool eeprom read logic (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: ethtool: Display physical connector type (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: restart interface when link settings are changed by user (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-sdpvf: Fix PTP options for SDP interfaces (Roy Franz)  [Orabug: 39318904]
- octeontx2-vf: Add partial ethtool support for SDP VFs (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Add page pool stats to ethtool (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Add missing changes in otx2_ethtool.c (Suman Ghosh)  [Orabug: 39318904]
- Octeontx2-pf: tc: fix egress ratelimiting (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Support to enable EDSA/Higig2 pkts parsing (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Using compound/head page ref count (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Fix NDC sync operation errors (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: cn20k: fix target address (Juan Garcia)  [Orabug: 39318904]
- octeontx2-pf: Check address for Null before free (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Add soft reset sequence in mcs_global_cfg() (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-pf: mcs: Don't account field alignment when installing TX SecY policy (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix start and end bit for scan config (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: npc: cn20k: Remove function (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: npc: cn20k: refactor code (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cgx: misc changes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: reset TL1 SW_XOFF before returning from link mode change (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Remove MAC address validation check (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Show count of dropped packets by DMAC filters (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Update mbox version (Sunil Goutham)  [Orabug: 39318904]
- cn10k-ipsec: Fix compilation with XFRM_OFFLOAD enabled (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-vf: Register dummy netdev for host PF VFs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Configure SQ default channel based on UP message (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Dereference only a valid pointer (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-vf: Fix VF mbox up message error on PTP RX enable (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: Add support for creating netdev interfaces for SDP VFs (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Add more debug messages (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Send UP messages to VF only when VF is up. (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Avoid null pointer dereference (Subbaraya Sundeep)  [Orabug: 39318904]
- cn10k-ipsec: fix uninitialized send queue during ESP offload (Shashank Gupta)  [Orabug: 39318904]
- cn10k-ipsec: Initialize ipsec queues on enabling IPsec (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: cn10k/cn20k: Update count_eot in NPA_LF_AURA_BATCH_FREE0 (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: persist netdev stats across routine operations (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-pf: Add self test (Linu Cherian)  [Orabug: 39318904]
- octeontx2-pf: Add ethtool -m option support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Skip dma map and unmap when IOMMU is bypassed (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-pf: Add NIXLF error/poison interrupt handlers (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-pf: Validation for TL1 Round robin priority (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: devlink param support to modify physical interface links. (Rakesh Babu)  [Orabug: 39318904]
- octeontx2-pf: Add devlink param to vary rbuf size (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Add devlink param to vary cqe size (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: CN20k: add multi chiplet support to NIX path (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Enable TX PTP timestamping on BPHY NIX link (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cn10k: Fix accessing invalid CSRs (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: fix fwdata NULL pointer dereference when RPM probe fails (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Map BPHY chiplet RPMs followed by compute chiplet RPMs (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Add chiplet RPM AF mbox support for port ready, get channel info messages. (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cnf20k: account for XCB RPM links in CGX link calculation (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Add support for chiplet based BPHY RPM driver as AF RVU extension block module (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Add BPHY chiplet, RPM, LMAC data to fwdata (Sai Krishna)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Register driver with PCI subsys ID (Anshumali Gaur)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Fix MSI-X init failure by setting both DMA masks (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20K: Add build and config support for CPRI PF driver to avoid module conflicts (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Fix CPRI MSI-X initialization failure (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Add workaround for gpint issue for CPRI pkt path (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Add cpri netdev driver support (Viswajith Murali)  [Orabug: 39318904]
- octeontx-bphy-netdev: Fix unexpected packet in netdev by ensuring proper PSW hardware write handling (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-bphy-netdev: allow forcing ts steps cnt (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix fec counters reporting (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix ecpri pkt stats update (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix ecpri type5 handling (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix a deadlock in cpri (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix race condition for timestamp packets (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix kernel crash by using proper max PSM queue count (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: protect psm queue access (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix debugfs memleak (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Detect DL circular buffer full (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix rsfec stats reading (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Support for eCPRI MsgType5 timestamping (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Use correct netdev priv structure for debugging (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: disable CPRI RX on cleanup (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: ignore mcs untagged error (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: disable rx on RFOEs on exit (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix crash issue during initialization of cpri, rfoe interfaces on set MAC address (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: OcteonTX2 Base PHY RFOE netdev driver (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver msix, interrupt handling (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Move DPI block reset handling to AF extension block driver (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver channel table mbox support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver mbox support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver initial support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cn20k: Don't reset the PF_DISC register (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: CN20K: update RPM links (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add block discovery register (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix PTP RX enable mbox fail issue over NIC VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Modify NIX register offset value for CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Validate NIX maximum LFs correctly (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix incorrect BPID initialization for CPT channels (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow CPT PF access to CPT_AF_GRPX_THR (Shashank Gupta)  [Orabug: 39318904]
- octeontx2-af: cn20k: support packet data buffer (pdb) configuration (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Set LBK channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix config parameter check when disable inline queue (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable CPT parse and Frag info header byte swap (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Add an MCAM entry to count CPT 2nd pass miss packets (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: support overriding aura to zero for second pass (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Use proper mask to get max CPT LF's (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: allow mbox access from CPT VFs for backward compatibility (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: Drop CPT PF/VF check for relevant mboxes (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Change CPT channels configuration (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow CPT PF access to CPTX_AF_CTX_PSP_TIMER_CTL (Shashank Gupta)  [Orabug: 39318904]
- octeontx2-af: cn20k: change CPT register address as per latest csr (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow access to CPT_AF_UCCX_CTL (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: CN20K channel configuration (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable RXC on inline inbound cptlf (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix RXC flush and cleanup sequence (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add CPT CTX flush support (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: fix CPT ctx flush (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: cn20k: Setup CPT reassembly Queue Configuration Register (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Move RXC specific functions (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: cn20k: handle multi-queue reassembly teardown (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for NIX RX inline configuration (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for CPT RX inline configuration (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for CPT RX queue allocation (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mbox to configure rx inline nixlf (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mbox to configure rx inline profile (Bharat Bhushan)  [Orabug: 39318904]
- crypto: octeontx2: Add new mailbox to set queue priority (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add rxc teardown support (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add queue id to rxc time config mbox (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add cpt stats mailbox support (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: add FLT interrupts (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: Unify HW interrupt APIs (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx-af: cpt: Get CPT PF number using PF Device ID (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Update max engine calculation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Add TC rules support for CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Set correct sequence for carrier off and tx queue stop (Suman Ghosh)  [Orabug: 39318904]
- octeontx2: Fix klockwork issues. (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Free queue memory allocated sq timestamp (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Check for DMAC extraction support before setting DMAC based hardware filter for a VF (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Move REP devlink APIs to separate file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix representor up notification events (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Use ews_rules value to update REP tcam rules (Geetha sowjanya)  [Orabug: 39318904]
- Octeontx2-af: Change args for rvu_get_pf (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add validation before accessing fwdata (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: map management port always to first PF (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: replace generic error codes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: link mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Assign CGX id from PCI revision id (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Remove MAC address validation check (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: lmac validation with is_lmac_valid (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix compilation warning/klockwork issues (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: configure 802.3 pause frames in SGMII/QSGMII mode (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add new CGX_CMDs to set and get PHY modulation type (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Do not allow VFs to overwrite PKIND config (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Put CGX LMAC also in Higig2 mode (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-sdp: Add FLR interrupts for Host PFs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Refactor SDP interrupts code (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Fix SDP channel numbers in NPC rules (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Check whether SDP block is present before access (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: sdp: Fix address range assignment logic (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: sdp: Maintain host to RVU GEN PF mapping (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: misc SDP fixes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx-af: cn20k: Manage rings allocation and freeing (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: CN20K: SDP mbox framework (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: CN20K: SDP extension driver (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-pf: enable AF_XDP zero copy support (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix clearing TL3_TL2X_LINKX_CFG[ENA] during SMQ flush to drop packets (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Fix ROCEV2 RSS hashing QP ID length (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Allow to set CPT result address offset (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for NIX flow vector configuration (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: add ROCEv2 header for RSS hashing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Update lbk maximum frame size as per CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: fix TX scheduler count (Satha Rao)  [Orabug: 39318904]
- octeontx2-af: Fix the issue of infinite loop in nix_aq_reset (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Misc changes in NIX block (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Dump hw register state on error (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add new mailbox to configure LSO alt flags (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Extend SPI to SA index translation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: notify VF about ptp event (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: Sending tsc value to the userspace (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: Support for PTP notification to PF (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: npa: fix DPC permit register access (Ashwin Sekhar T K)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add DPC support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add debugfs support for Halo (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add NPA Halo support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Fix number of entries in the kpu3 cam (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix subbank count (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix number of entries in the kpu2 cam (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add mbox to read default rule (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: kpu: Input validation check. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: kpu: Fix lodable profile issue (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Convert to C99 flexible array (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Restore stats in defrag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Flow delete and free mbox (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Add traces in NPC mailboxes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix KPU9 state variable for ROCEV2 (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add support for ROCEv2 header parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add more VLAN tag parsing in case of E-tag (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flags for cn20k (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Avoid updating cn10k registers during cn20k reboot (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Do not access match stats for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: Update NPC CSRs (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix out of bound access in entry2counter array (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix initialization of mcam's entry2target_pffunc field (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flag extraction in parse nibble (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix CPT CGX channel mask for cn20k (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flag in KPU profile for CN20K (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: fix mcam hit counter (Satheesh Paul)  [Orabug: 39318904]
- Revert "octeontx2-af: npc: cn20k: Get base steer rule index." (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: fix rule type for LBK VF (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: Fix failed to load custom pfl warning (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: add changes to update CPT pad length offset in KPU (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix search order (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: Use dev_dbg() (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix compilation warnings (Sunil Goutham)  [Orabug: 39318904]
- octeontx2: cn20k: npc: Set action2 for x2 entries. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable action2 programming in npc (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Set default profile DYNAMIC (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix csr register field offset. (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Reject request for x4 entries in x2 profile. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Alloc mcam entry for install flow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Disable fw load faiure warning (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Load custom kpu profile from filesystem. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix install flow priority (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add support for custom mkex profiles (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Get base steer rule index. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Stats support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cn20k: Reject mcam alloc mbox with invalid keytype (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Reserve x4 key mcam entries for ntuple (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Get kex related info from PF. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix parse result nibble mask reading. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Set correct nibble bits for cn20k (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix parse nibble mask (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Avoid accessing cn10k registers (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add new mailboxes for CN20K silicon (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix npc_mcam_get_hit_status mbox for cn10k (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Convert vidx to mcam_idx in mbox handler (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add an mbox interface to defrag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: defragmentation support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Introduce virtual mcam index (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Validate mcam index before enable/disable (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add new mailboxes to get kex config and free counts (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Use common APIs to read/write/copy/enable mcam entry (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Add a new mbox to read/write MCAM hit status (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: debugfs support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Use common APIs to alloc/free/get mcam index. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Allocate default mcam indexes. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Modify alloc entry mailbox (Suman Ghosh)  [Orabug: 39318904]
- ocetontx2-af: npc: cn20k: MKEX profile support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: KPM profile changes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Index management. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: Fix klockwork issues. (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix Support of FDSA tag (George Cherian)  [Orabug: 39318904]
- octeontx2-af: Support for FDSA tag (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Adding changes to parse stacked VLANs (Kiran Kumar K)  [Orabug: 39318904]
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix issue with GRE parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add support to parse more VLAN headers (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix issue with IPV6 GRE and multi VLAN (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add KPU changes to parse fabric path header (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add few missing changes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: allow second pass pkts via default ucast entry (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: suppress kpu profile loading warning (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: use cpt channel mask in flow install path (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: Add NPC support to filter GTP-U and GTP-C packets based on TEID (Suman Ghosh)  [Orabug: 39318904]
- octeontx2: cn20k: Assign unique MCS IDs based on PCI enumeration (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-pf: Choose macsec encryption offload per packet (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: mcs: Use new SCI CAM in hardware (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: mcs: Fix mcs resources free on PF shutdown (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Add devlink parameter to toggle MCS bypass mode (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Display port mapped stats for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add MCS LMAC channel and count configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs set mcs id and silicon check (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix mcs tx_sa_map API (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mcs PN threshold support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: MCS add port configure APIs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: Add MCS parser configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix mcs register offsets (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix unsupported secy stats read (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add MCS support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: mcs: Remove SA stats support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cnf10k-b: mcs: Fix stats reg address (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: rvu: enable mcs fips mailboxes (Ankur Dwivedi)  [Orabug: 39318904]
- octeontx2-af: mcs: add mailboxes for fips (Ankur Dwivedi)  [Orabug: 39318904]
- octeontx2-af: sso: clear all the sets on init (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: tim: add ring priority support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: update TIM interval support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: moderate SSO AF error interrupts (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: lower TIM bucket skip IRQ log level (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: remove GTI clock adjustment (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: update xaq aura offset (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: cleanup SSO EVA on LF reset (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO HW info mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO AGGR config and stats mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO EVA error interrupts (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: update masks for CN20K resources (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: Fixed compilation warnings (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: fix interval flag check (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add TIM hardware info mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add TIM HWWQE mbox support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add mbox to capture counters (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: reveal only TIM params that are available (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: add TIM error af interrupt handlers (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: clear state on TIM ring disable (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: disable preemption when enabling TIM (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: account for cycle wraparound (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: prevent TIM register read reorder (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: fix arguments passed to XAQ aura deinit (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: debugfs: fix undefined SSO register access (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: update TIM adjust GTI errata silicons (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: update TIM adjust GTI errata silicons (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: add TIM adjust GTI errata workaround (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: cn10k: devlink params to configure TIM (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: TIM: Set conditional clock always on (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Apply relevant HW issue workarounds for 96xx B0 silicon (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: Add SSO and TIM units support to the AF driver (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: enable rxc with lookaside cpt lf (Vidya Sagar Velumuri)  [Orabug: 39318904]
- octeontx2-af: fix issue with spitosa table teardown (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: fix cflags include paths (Wladislav Wiebe)  [Orabug: 39318904]
- octeontx2-af: Move out REE mbox messages (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add generic mbox handler for Eblock (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Use AF extension block interface (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add RVU AF extension block interface (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Introducing REE block for 98xx (Smadar Fuks)  [Orabug: 39318904]
- octeontx2-af: fix VF bringup affecting PF promiscous state (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: consider mode when using cpt base channel for bp (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: Update minimum receive frame size (Sathesh Edara)  [Orabug: 39318904]
- octeontx2-af: set default min and max rx len for CPT link (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: add NIX mbox message to get HW info (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: fix inline inbound IPsec configuration (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: support for custom L2 header (Satheesh Paul A)  [Orabug: 39318904]
- octeontx2-af: fix to get different rq mask (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: poll for tx link credits before link mode change (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Handle physical link state change requests (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add mbox to alloc/free BPIDs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Dynamically allocate bpids for CPT and LBK (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support for SPI to SA index translation (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Update HW workarounds for 96xx C0, 98xx and F95xx B0 chips (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add devlink support to configure TL1 RR_PRIO (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: add support for CPT second pass (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: add new mbox to support sync cycle on rx path (Satha Rao)  [Orabug: 39318904]
- octeontx2-af: add support for changing vlan tpid (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-pf: Fix devm_kcalloc() error checking (Dan Carpenter)  [Orabug: 39318904]
- octeontx2-pf: Use new bandwidth profiles in receive queue (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Display new bandwidth profiles too in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Accommodate more bandwidth profiles for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Initialize new NIX SQ context for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Initialize cn20k specific aura and pool contexts (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Skip NDC operations for cn20k (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Extend debugfs support for cn20k NPA (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add cn20k NPA block contexts (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Extend debugfs support for cn20k NIX (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Add cn20k NIX block contexts (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Simplify context writing and reading to hardware (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: convert to ndo_hwtstamp API (Vadim Fedorenko)  [Orabug: 39318904]
- Octeontx2-af: Fix pci_alloc_irq_vectors() return value check (Harshit Mogalapalli)  [Orabug: 39318904]
- Octeontx2-af: Fix missing error code in cgx_probe() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-pf: fix bitmap leak (Bo Sun)  [Orabug: 39318904]
- octeontx2-vf: fix bitmap leak (Bo Sun)  [Orabug: 39318904]
- octeontx2-af: Remove unused declarations (Yue Haibing)  [Orabug: 39318904]
- Octeontx2-af: Fix NIX X2P calibration failures (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-vf: Fix max packet length errors (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Broadcast XON on all channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: use unsigned int as iterator for unsigned values (Simon Horman)  [Orabug: 39318904]
- net: Fix typos (Bjorn Helgaas)  [Orabug: 39318904]
- Octeontx2-af: Debugfs support for firmware data (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: RPM: Update DMA mask (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Disable stale DMAC filters (Subbaraya Sundeep)  [Orabug: 39318904]
- Octeontx2-af: Add programmed macaddr to RVU pfvf (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix error code in rvu_mbox_init() (Dan Carpenter)  [Orabug: 39318904]
- Octeontx2-pf: ethtool: support multi advertise mode (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Introduce mode group index (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx-pf: Update SGMII mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix rvu_mbox_init return path (Subbaraya Sundeep)  [Orabug: 39318904]
- Octeontx2-pf: Fix Backpresure configuration (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: CN20K mbox implementation between PF-VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20K mbox implementation for AF's VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: CN20K mbox REQ/ACK implementation for NIC PF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k mbox to support AF REQ/ACK functionality (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k basic mbox operations and structures (Sai Krishna)  [Orabug: 39318904]
- octeontx2: Set appropriate PF, VF masks and shifts based on silicon (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Avoid typecasts by simplifying otx2_atomic64_add macro (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Annotate mmio regions as __iomem (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: macsec: Get MACSEC capability flag from AF (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Add MACSEC capability flag (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Send Link events one by one (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: NPC: Clear Unicast rule on nixlf detach (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Avoid adding dcbnl_ops for LBK and SDP vf (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Add tracepoint for NIX_PARSE_S (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Add new tracepoint otx2_msg_status (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Add pcifunc also to mailbox tracepoints (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Display names for CPT and UP messages (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: convert dev_dbg to tracepoint in mbox (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Fix ethtool support for SDP representors (Hariprasad Kelam)  [Orabug: 39318904]
- net: octeontx2: Use pure PCI devres API (Philipp Stanner)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP: code clean up (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Remove unused rvu_npc_enable_bcast_entry (Dr. David Alan Gilbert)  [Orabug: 39318904]
- xfrm: Add explicit dev to .xdo_dev_state_{add,delete,free} (Cosmin Ratiu)  [Orabug: 39318904]
- octeontx2-pf: handle otx2_mbox_get_rsp errors (Chenyuan Yang)  [Orabug: 39318904]
- net: octeontx2: Handle XDP_ABORTED and XDP invalid as XDP_DROP (Lorenzo Bianconi)  [Orabug: 39318904]
- octeontx2-af: mcs: Remove redundant 'flush_workqueue()' calls (Chen Ni)  [Orabug: 39318904]
- net: octeontx2: Add metadata support for xdp mode (Lorenzo Bianconi)  [Orabug: 39318904]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 39318904]
- octeontx2: hide unused label (Arnd Bergmann)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP zero copy transmit support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Prepare for AF_XDP (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Reconfigure RSS table after enabling AF_XDP zerocopy on rx queue (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP zero copy receive support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: use xdp_return_frame() to free xdp buffers (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: mcs: Remove dead code and semi-colon from rsrc_name() (Nihar Chaithanya)  [Orabug: 39318904]
- octeontx2-pf: fix error handling of devlink port in rvu_rep_create() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-pf: fix netdev memory leak in rvu_rep_create() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-af: fix build regression without CONFIG_DCB (Arnd Bergmann)  [Orabug: 39318904]
- cn10k-ipsec: Fix compilation error when CONFIG_XFRM_OFFLOAD disabled (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Fix installation of PF multicast rule (Geetha sowjanya)  [Orabug: 39318904]
- cn10k-ipsec: Enable outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Allow ipsec crypto offload for skb with SA (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Process outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Add SA add/del support for outb ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Init hardware for outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Disable backpressure between CPT and NIX (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Move skb fragment map/unmap to common code (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: map skb data as device writeable (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Fix SDP MAC link credits configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Fix spelling mistake "reprentator" -&gt; "representor" (Colin Ian King)  [Orabug: 39318904]
- octeontx2-pf: Adds TC offload support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Implement offload stats ndo for representors (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add devlink port support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add representors for sdp MAC (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Configure VF mtu via representor (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add support to sync link state between representor and VFs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Get VF stats via representor (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add packet path between representor and VF (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add basic net_device_ops (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Create representor netdev (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: RVU representor driver (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Knobs for NPC default rule counters (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Refactor few NPC mcam APIs (Linu Cherian)  [Orabug: 39318904]
- octeontx2-pf: Move shared APIs to header file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Reuse PF max mtu value (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add new APIs for queue memory alloc/free. (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Define common API for HW resources configuration (Geetha sowjanya)  [Orabug: 39318904]
- net: marvell: use ethtool string helpers (Rosen Penev)  [Orabug: 39318904]
- uek: kabi: update kABI files for new symbols (Saeed Mirzamohammadi)  [Orabug: 39268116]
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39167615]  {CVE-2026-31402}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39110670]  {CVE-2026-23278}
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39103229]  {CVE-2026-23270}</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.5.el10uek]" date="1779192000">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39407652]  {CVE-2026-46333}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.6.el10uek]" date="1779796800">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39442660]  {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39442660]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.7.el10uek]" date="1779969600">- tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi)  [Orabug: 39456024]
- tap: free page on error paths in tap_get_user_xdp() (Weiming Shi)  [Orabug: 39456024]
- tun: free page on short-frame rejection in tun_xdp_one() (Weiming Shi)  [Orabug: 39456024]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.7.1.el10uek]" date="1780315200">- smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39474418]</changelog>
</package>
<package pkgid="2fddedd15ef989b4e778222d36c784f5abe20fbd" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="100.28.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.2.el10uek]" date="1751198400">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
</package>
<package pkgid="3df71aad5495441d50239fa144d1fcef26833eea" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="100.28.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.el10uek]" date="1743681600">- block: prevent calls to should_fail_bio() optimized by gcc (Prasad Singamsetty)  [Orabug: 37782458]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)   
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]  
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]  
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
</package>
<package pkgid="6804ea6de2e3976222ff648cab2222fcc67e6660" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="101.33.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge) [Orabug: 37976747] {CVE-2025-37903}
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi) [Orabug: 37976752] {CVE-2025-37905}
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [Orabug: 37976858] {CVE-2025-37932}
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski) [Orabug: 37976760] {CVE-2025-37907}
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang) [Orabug: 37976762] {CVE-2025-37908}
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh Edara) [Orabug: 37976864] {CVE-2025-37933}
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan) [Orabug: 37976765] {CVE-2025-37909}
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon) [Orabug: 37976771] {CVE-2025-37910}
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang) [Orabug: 37976728] {CVE-2025-37894}
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein) [Orabug: 37976869] {CVE-2025-37934}
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab) [Orabug: 37976773] {CVE-2025-37911}
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh Ap)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya Kn) [Orabug: 37976731] {CVE-2025-37895}
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe) [Orabug: 37976872] {CVE-2025-37935}
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai) [Orabug: 37970918] {CVE-2025-37891}
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Luoxuanqiang) [Orabug: 37976779] {CVE-2025-37912}
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976783] {CVE-2025-37913}
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976788] {CVE-2025-37914}
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira) [Orabug: 37970915] {CVE-2025-37890}
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976792] {CVE-2025-37915}
- pds_core: remove write-after-free of client_id (Shannon Nelson) [Orabug: 37976797] {CVE-2025-37916}
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud) [Orabug: 37976802] {CVE-2025-37917}
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu) [Orabug: 37976804] {CVE-2025-37918}
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu) [Orabug: 37976806] {CVE-2025-37919}
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (Eryk Kubanski) [Orabug: 37976809] {CVE-2025-37920}
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel) [Orabug: 37976815] {CVE-2025-37921}
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov) [Orabug: 37976734] {CVE-2025-37897}
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom) [Orabug: 37976819] {CVE-2025-37922}
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Sun Peng Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park) [Orabug: 37976821] {CVE-2025-37923}
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan) [Orabug: 37976738] {CVE-2025-37899}
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan) [Orabug: 37976828] {CVE-2025-37924}
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon) [Orabug: 37976832] {CVE-2025-37926}
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen) [Orabug: 37976741] {CVE-2025-37900}
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov) [Orabug: 37976836] {CVE-2025-37927}
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (Longping Wei) [Orabug: 37976844] {CVE-2025-37928}
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Xu Wang) [Orabug: 37977118] {CVE-2025-37990}
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold) [Orabug: 37976744] {CVE-2025-37901}
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson) [Orabug: 37976874] {CVE-2025-37936}
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller) [Orabug: 37977127] {CVE-2025-37991}
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon) [Orabug: 37977182] {CVE-2025-37929}
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner) [Orabug: 37976850] {CVE-2025-37930}
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik) [Orabug: 37976853] {CVE-2025-37931}
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya) [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil) [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert) [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter) [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King) [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche) [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert) [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar) [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang) [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli) [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre) [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta) [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon) [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon) [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth) [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth) [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick) [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli) [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval) [Orabug: 37930100] {CVE-2025-37821}
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang) [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed) [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan) [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.31.1.el10uek]" date="1748952000">- LTS version: v6.12.31 (Jack Vogel)
- drm/gem: Internally test import_attach for imported objects (Thomas Zimmermann)
- x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers (Balbir Singh)
- i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() (Nathan Chancellor)
- pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group() (Dan Carpenter)
- watchdog: aspeed: fix 64-bit division (Arnd Bergmann)
- drm/amdkfd: Correct F8_MODE for gfx950 (Amber Lin)
- serial: sh-sci: Save and restore more registers (Geert Uytterhoeven)
- bpf: abort verification if env-&gt;cur_state-&gt;loop_entry != NULL (Eduard Zingerman)
- drm/amd/display: Exit idle optimizations before accessing PHY (Ovidiu Bunea)
- kbuild: Properly disable -Wunterminated-string-initialization for clang (Nathan Chancellor)
- Fix mis-uses of 'cc-option' for warning disablement (Linus Torvalds)
- gcc-15: disable '-Wunterminated-string-initialization' entirely for now (Linus Torvalds)
- gcc-15: make 'unterminated string initialization' just a warning (Linus Torvalds)
- err.h: move IOMEM_ERR_PTR() to err.h (Raag Jadav)
- spi: spi-fsl-dspi: Reset SR flags before sending a new message (Larisa Grigore)
- spi: spi-fsl-dspi: Halt the module after a new message transfer (Bogdan-Gabriel Roman)
- spi: spi-fsl-dspi: restrict register range for regmap access (Larisa Grigore)
- spi: use container_of_cont() for to_spi_device() (Greg Kroah-Hartman)
- platform/x86: think-lmi: Fix attribute name usage for non-compliant items (Mark Pearson)
- ksmbd: fix stream write failure (Namjae Jeon)
- Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection" (Jernej Skrabec)
- Bluetooth: btmtksdio: Do close if SDIO card removed without close (Chris Lu)
- Bluetooth: btmtksdio: Check function enabled before doing close (Chris Lu)
- nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() (Ryusuke Konishi)
- mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled (Ignacio Moreno Gonzalez)
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Tianyang Zhang)
- memcg: always call cond_resched() after fn() (Breno Leitao)
- highmem: add folio_test_partial_kmap() (Matthew Wilcox)
- Input: xpad - add more controllers (Vicki Pfau)
- Revert "drm/amd: Keep display off while going into S4" (Mario Limonciello)
- smb: client: Reset all search buffer pointers when releasing buffer (Zhaolong Wang)
- arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (Gabor Juhos)
- smb: client: Fix use-after-free in cifs_fill_dirent (Zhaolong Wang) [Orabug: 38094970] {CVE-2025-38051}
- drm/edid: fixed the bug that hdr metadata was not reset (Feijuan Li)
- thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature (Zhang Rui)
- platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin) [Orabug: 38095141] {CVE-2025-38077}
- pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
- pmdomain: renesas: rcar: Remove obsolete nullify checks (Geert Uytterhoeven)
- vmxnet3: update MTU after device quiesce (Ronak Doshi)
- net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
- can: kvaser_pciefd: Fix echo_skb race (Axel Forsman)
- can: kvaser_pciefd: Continue parsing DMA buf after dropped RX (Axel Forsman)
- llc: fix data loss when reading from a socket in llc_ui_recvmsg() (Gavrilov Ilia)
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10 (Ed Burcher)
- ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [Orabug: 38095145] {CVE-2025-38078}
- ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction (Peter Ujfalusi)
- ASoc: SOF: topology: connect DAI to a single DAI link (Kai Vehmanen)
- ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext (Peter Ujfalusi)
- can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp) [Orabug: 38049369] {CVE-2025-38003}
- can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 38049374] {CVE-2025-38004}
- can: slcan: allow reception of short error messages (Carlos Sanchez)
- padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094842] {CVE-2025-38031}
- crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [Orabug: 38095153] {CVE-2025-38079}
- clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe() (André Draszik)
- octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG (Geetha Sowjanya)
- octeontx2-af: Set LMT_ENA bit for APR table entries (Subbaraya Sundeep)
- net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang) [Orabug: 38094978] {CVE-2025-38052}
- octeontx2-pf: Add AF_XDP non-zero copy support (Suman Ghosh)
- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [Orabug: 38049357] {CVE-2025-38000}
- idpf: fix idpf_vport_splitq_napi_poll() (Eric Dumazet)
- io_uring: fix overflow resched cqe reordering (Pavel Begunkov)
- net: lan743x: Restore SGMII CTRL register on resume (Thangaraj Samynathan)
- net: dwmac-sun8i: Use parsed internal PHY address instead of 1 (Paul Kocialkowski)
- pinctrl: qcom: switch to devm_register_sys_off_handler() (Dmitry Baryshkov)
- loop: don't require -&gt;write_iter for writable files in loop_configure (Christoph Hellwig)
- idpf: fix null-ptr-deref in idpf_features_check (Pavan Kumar Linga) [Orabug: 38094982] {CVE-2025-38053}
- ice: Fix LACP bonds without SRIOV environment (Dave Ertman)
- ice: fix vf-&gt;num_mac count with port representors (Jacob Keller)
- bridge: netfilter: Fix forwarding of fragmented packets (Ido Schimmel)
- ptp: ocp: Limit signal/freq counts in summary output functions (Sagi Maimon) [Orabug: 38094984] {CVE-2025-38054}
- Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling (En-Wei Wu)
- Bluetooth: L2CAP: Fix not checking l2cap_chan security level (Luiz Augusto von Dentz)
- perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter) [Orabug: 38094988] {CVE-2025-38055}
- irqchip/riscv-imsic: Start local sync timer on correct CPU (Andrew Bresticker)
- ASoC: SOF: Intel: hda: Fix UAF when reloading module (Tavian Barnes) [Orabug: 38094991] {CVE-2025-38056}
- devres: Introduce devm_kmemdup_array() (Raag Jadav)
- driver core: Split devres APIs to device/devres.h (Andy Shevchenko)
- dmaengine: fsl-edma: Fix return code for unhandled interrupts (Stefan Wahren)
- dmaengine: idxd: Fix -&gt;poll() return value (Dave Jiang)
- xfrm: Sanitize marks before insert (Paul Chaignon)
- clk: sunxi-ng: d1: Add missing divider for MMC mod clocks (Andre Przywara)
- remoteproc: qcom_wcnss: Fix on platforms without fallback regulators (Matti Lehtimäki)
- kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() (David Hildenbrand)
- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (Seongman Lee)
- dmaengine: idxd: Fix allowing write() from different address spaces (Vinicius Costa Gomes)
- xfrm: Fix UDP GRO handling for some corner cases (Tobias Brunner)
- espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca)
- espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094993] {CVE-2025-38057}
- soundwire: bus: Fix race on the creation of the IRQ domain (Charles Keepax)
- __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [Orabug: 38095000] {CVE-2025-38058}
- drm/amd/display: Call FP Protect Before Mode Programming/Mode Support (Austin Zheng)
- xenbus: Allow PVH dom0 a non-local xenstore (Jason Andryuk)
- x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust &gt;= 1.88 (Paweł Anikiel) [Orabug: 38094847] {CVE-2025-38033}
- wifi: iwlwifi: add support for Killer on MTL (Johannes Berg)
- block: only update request sector if needed (Johannes Thumshirn)
- tools: ynl-gen: validate 0 len strings from kernel (David Wei)
- btrfs: avoid NULL pointer dereference if no valid csum tree (Qu Wenruo) [Orabug: 38095010] {CVE-2025-38059}
- btrfs: handle empty eb-&gt;folios in num_extent_folios() (Boris Burkov)
- btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [Orabug: 38094856] {CVE-2025-38034}
- btrfs: compression: adjust cb-&gt;compressed_folios allocation type (Kees Cook)
- ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers (Stefan Binding)
- cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function (Pali Rohár)
- cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info() (Pali Rohár)
- io_uring/fdinfo: annotate racy sq/cq head/tail reads (Jens Axboe)
- nvmet-tcp: don't restore null sk_state_change (Alistair Francis) [Orabug: 38094863] {CVE-2025-38035}
- ALSA: usb-audio: Fix duplicated name in MIDI substream names (Takashi Iwai)
- nvme-pci: add quirks for WDC Blue SN550 15b7:5009 (Guan Wentao)
- nvme-pci: add quirks for device 126f:1001 (Guan Wentao)
- ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 (Takashi Iwai)
- ASoC: cs42l43: Disable headphone clamps during type detection (Charles Keepax)
- platform/x86: ideapad-laptop: add support for some new buttons (Gašper Nemgar)
- platform/x86: asus-wmi: Disable OOBE state after resume from hibernation (Pavel Nikulin)
- platform/x86/intel: hid: Add Pantherlake support (Saranya Gopal)
- smb: server: smb2pdu: check return value of xa_store() (Salah Triki)
- pinctrl: meson: define the pull up/down resistor value as 60 kOhm (Martin Blumenstingl)
- book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n (Ritesh Harjani)
- ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of() (Chenyuan Yang)
- drm: Add valid clones check (Jessica Zhang)
- drm/panel-edp: Add Starry 116KHD024006 (Douglas Anderson)
- drm/buddy: fix issue that force_merge cannot free all roots (Lin Cao)
- drm/atomic: clarify the rules around drm_atomic_state-&gt;allow_modeset (Simona Vetter)
- drm/xe: Reject BO eviction if BO is bound to current VM (Oak Zeng)
- drm/xe/sa: Always call drm_suballoc_manager_fini() (Michal Wajdeczko)
- wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event (Ching-Te Ku)
- drm/xe: Do not attempt to bootstrap VF in execlists mode (Maarten Lankhorst)
- drm/xe: Move suballocator init to after display init (Maarten Lankhorst)
- wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (P Praneesh)
- drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE (Zhi Wang)
- drm: bridge: adv7511: fill stream capabilities (Olivier Moysan)
- wifi: ath12k: Fix end offset bit definition in monitor ring descriptor (P Praneesh)
- wifi: ath12k: Fetch regdb.bin file from board-2.bin (Aaradhana Sahu)
- wifi: ath9k: return by of_get_mac_address (Rosen Penev)
- drm/xe/pf: Reset GuC VF config when unprovisioning critical resource (Michal Wajdeczko)
- accel/qaic: Mask out SR-IOV PCI resources (Youssef Samir)
- wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override (Nicolas Escande)
- regulator: ad5398: Add device tree support (Isaac Scott)
- spi: zynqmp-gqspi: Always acknowledge interrupts (Sean Anderson)
- wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet (Ping-Ke Shih)
- wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate (Bitterblue Smith)
- wifi: rtl8xxxu: retry firmware download on error (Soeren Moch)
- clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation (Lad Prabhakar)
- perf/amd/ibs: Fix -&gt;config to sample period calculation for OP PMU (Ravi Bangoria)
- perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (Ravi Bangoria)
- firmware: arm_scmi: Relax duplicate name constraint across protocol ids (Sudeep Holla)
- bpftool: Fix readlink usage in get_fd_type (Viktor Malik)
- bpf: Use kallsyms to find the function name of a struct_ops's stub function (Martin Kafai Lau)
- drm/ast: Find VBIOS mode from regular display size (Thomas Zimmermann)
- dm vdo: use a short static string for thread name prefix (Matthew Sakai)
- dm vdo indexer: prevent unterminated string warning (Chung Chung)
- irqchip/riscv-aplic: Add support for hart indexes (Vladimir Kondratiev)
- ASoC: rt722-sdca: Add some missing readable registers (Charles Keepax)
- ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode (Cezary Rojewski)
- arm64: zynqmp: add clock-output-names property in clock nodes (Naman Trivedi Manojbhai)
- HID: usbkbd: Fix the bit shift number for LED_KANA (Junan)
- wifi: ath12k: Avoid napi_sync() before napi_enable() (Avula Sri Charan)
- scsi: st: Restore some drive settings after reset (Kai Mäkisara)
- net/mana: fix warning in the writer of client oob (Konstantin Taranov)
- drm/xe/relay: Don't use GFP_KERNEL for new transactions (Michal Wajdeczko)
- ice: count combined queues using Rx/Tx count (Michal Swiatkowski)
- perf: Avoid the read if the count is already updated (Peter Zijlstra)
- rcu: fix header guard for rcu_all_qs() (Ankur Arora)
- rcu: handle unstable rdp in rcu_read_unlock_strict() (Ankur Arora)
- rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y (Ankur Arora)
- ice: treat dyn_allowed only as suggestion (Michal Swiatkowski)
- ice: init flow director before RDMA (Michal Swiatkowski)
- bridge: mdb: Allow replace of a host-joined group (Petr Machata)
- net: flush_backlog() small changes (Eric Dumazet)
- r8169: don't scan PHY addresses &gt; 0 (Heiner Kallweit)
- ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only (Geert Uytterhoeven)
- vxlan: Annotate FDB data races (Ido Schimmel) [Orabug: 38094879] {CVE-2025-38037}
- cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (Dhananjay Ugwekar) [Orabug: 38094888] {CVE-2025-38038}
- tools: ynl-gen: don't output external constants (Jakub Kicinski)
- eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs (Alexander Duyck)
- drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0 (Cristian Ciocaltea)
- media: qcom: camss: Add default case in vfe_src_pad_code (Depeng Shao)
- media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available (Depeng Shao)
- f2fs: introduce f2fs_base_attr for global sysfs entries (Jaegeuk Kim)
- hwmon: (xgene-hwmon) use appropriate type for the latency value (Andrey Vatoropin)
- tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options (Len Brown)
- net: page_pool: avoid false positive warning if NAPI was never added (Jakub Kicinski)
- clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs (Jordan Crouse)
- wifi: rtw89: call power_on ahead before selecting firmware (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before accessing (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before getting its size (Ping-Ke Shih)
- wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang (Ching-Te Ku)
- wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix download_firmware_validate() for RTL8814AU (Bitterblue Smith)
- ext4: remove writable userspace mappings before truncating page cache (Zhang Yi)
- ext4: don't write back data before punch hole in nojournal mode (Zhang Yi)
- leds: trigger: netdev: Configure LED blink interval for HW offload (Marek Vasut)
- pstore: Change kmsg_bytes storage size to u32 (Kees Cook)
- iio: adc: ad7944: don't use storagebits for sizing (David Lechner)
- r8152: add vendor/device ID pair for Dell Alienware AW1022z (Aleksander Jan Bajkowski)
- ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). (Kuniyuki Iwashima)
- arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src (Athira Rajeev)
- powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (Gaurav Batra)
- powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Gaurav Batra)
- net: fec: Refactor MAC reset to function (Csókás Bence)
- wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx (Emmanuel Grumbach)
- wifi: mac80211: remove misplaced drv_mgd_complete_tx() call (Johannes Berg)
- wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() (Johannes Berg)
- wifi: iwlwifi: don't warn during reprobe (Miri Korenblit)
- wifi: iwlwifi: use correct IMR dump variable (Johannes Berg)
- mptcp: pm: userspace: flags: clearer msg if no remote addr (Matthieu Baerts)
- wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV (P Praneesh)
- xfrm: prevent high SEQ input in non-ESN mode (Leon Romanovsky)
- drm/v3d: Add clock handling (Stefan Wahren)
- net/mlx5e: reduce the max log mpwrq sz for ECPF and reps (William Tu)
- net/mlx5e: reduce rep rxq depth to 256 for ECPF (William Tu)
- net/mlx5e: set the tx_queue_len for pfifo_fast (William Tu)
- net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB (Alexei Lazar)
- net/mlx5: XDP, Enable TX side XDP multi-buffer support (Alexei Lazar)
- scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr() (Chaohai Chen)
- drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer() (Alex Deucher)
- drm/amdgpu: enlarge the VBIOS binary size limit (Morris Zhang)
- drm/amdgpu: Use active umc info from discovery (Lijo Lazar)
- drm/amd/display: Populate register address for dentist for dcn401 (Dillon Varone)
- drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It (Austin Zheng)
- drm/amd/display: Increase block_sequence array size (Joshua Aberback) [Orabug: 38095164] {CVE-2025-38080}
- drm/amd/display: Initial psr_version with correct setting (Tom Chung)
- drm/amd/display: Update CR AUX RD interval interpretation (George Shen)
- Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY" (Brandon Syu)
- drm/amd/display: Support multiple options during psr entry. (Martin Tsai)
- drm/amd/pm: Skip P2S load for SMU v13.0.12 (Asad Kamal)
- drm/amdgpu: reset psp-&gt;cmd to NULL after releasing the buffer (Jiang Liu)
- drm/amd/display: Don't try AUX transactions on disconnected link (Ilya Bakoulin)
- drm/amd/display: pass calculated dram_speed_mts to dml2 (Charlene Liu)
- drm/amdgpu: Set snoop bit for SDMA for MI series (Harish Kasiviswanathan)
- drm/amdkfd: fix missing L2 cache info in topology (Eric Huang)
- drm/amdgpu/mes11: fix set_hw_resources_1 calculation (Alex Deucher)
- net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size (Huacai Chen)
- soundwire: cadence_master: set frame shape and divider based on actual clk freq (Bard Liao)
- soundwire: amd: change the soundwire wake enable/disable sequence (Vijendar Mukunda)
- phy: exynos5-usbdrd: fix EDS distribution tuning (gs101) (André Draszik)
- phy: core: don't require set_mode() callback for phy_get_mode() to work (Dmitry Baryshkov)
- phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF (Damon Ding)
- pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down (Claudiu Beznea)
- serial: sh-sci: Update the suspend/resume support (Claudiu Beznea)
- sched: Reduce the default slice to avoid tasks getting an extra tick (Zihan Zhou)
- x86/traps: Cleanup and robustify decode_bug() (Peter Zijlstra)
- x86/ibt: Handle FineIBT in handle_cfi_failure() (Peter Zijlstra)
- drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set (Shuicheng Lin)
- drm/xe/debugfs: fixed the return value of wedged_mode_set (Xin Wang)
- clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate (Krzysztof Kozlowski)
- clk: qcom: ipq5018: allow it to be bulid on arm32 (Karl Chan)
- drm/xe: Fix xe_tile_init_noalloc() error propagation (Lucas De Marchi)
- drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init() (Lucas De Marchi)
- net/mlx4_core: Avoid impossible mlx4_db_alloc() order value (Kees Cook)
- media: v4l: Memset argument to 0 before calling get_mbus_config pad op (Sakari Ailus)
- media: i2c: imx219: Correct the minimum vblanking value (David Plowman)
- kunit: tool: Use qboot on QEMU x86_64 (Brendan Jackman)
- smack: Revert "smackfs: Added check catlen" (Konstantin Andreev)
- smack: recognize ipv4 CIPSO w/o categories (Konstantin Andreev)
- pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map (Valentin Caron)
- ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() (Kuninori Morimoto)
- ASoC: tas2764: Power up/down amp on mute ops (Hector Martin)
- ASoC: tas2764: Mark SW_RESET as volatile (Hector Martin)
- ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG (Hector Martin)
- ASoC: ops: Enforce platform maximum on initial value (Martin Povišer)
- firmware: xilinx: Dont send linux address to get fpga config get status (Siva Durga Prasad Paladugu)
- firmware: arm_ffa: Handle the presence of host partition in the partition info (Sudeep Holla)
- firmware: arm_ffa: Reject higher major version as incompatible (Sudeep Holla)
- net/mlx5: Apply rate-limiting to high temperature warning (Shahar Shitrit)
- net/mlx5: Modify LSB bitmask in temperature event to include only the first bit (Shahar Shitrit)
- media: test-drivers: vivid: don't call schedule in loop (Hans Verkuil)
- irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base (Andrew Jones)
- hrtimers: Replace hrtimer_clock_to_base_table with switch-case (Andy Shevchenko)
- vxlan: Join / leave MC group after remote changes (Petr Machata)
- ACPI: HED: Always initialize before evged (Xiaofei Tan)
- PCI: Fix old_size lower bound in calculate_iosize() too (Ilpo Järvinen)
- eth: mlx4: don't try to complete XDP frames in netpoll (Jakub Kicinski)
- bpf: copy_verifier_state() should copy 'loop_entry' field (Eduard Zingerman) [Orabug: 38095018] {CVE-2025-38060}
- bpf: don't do clean_live_states when state-&gt;loop_entry-&gt;branches &gt; 0 (Eduard Zingerman)
- can: c_can: Use of_property_present() to test existence of DT property (Krzysztof Kozlowski)
- pmdomain: imx: gpcv2: use proper helper for property detection (Ahmad Fatoum)
- RDMA/core: Fix best page size finding when it can cross SG entries (Michael Margolin)
- serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (Alexis Lothoré) [Orabug: 38094901] {CVE-2025-38040}
- drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink (Harry Wentland)
- Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP" (Leo Zeng)
- drm/amd/display: Read LTTPR ALPM caps during link cap retrieval (George Shen)
- drm/amd/display: Fix BT2020 YCbCr limited/full range input (Ilya Bakoulin)
- drm/amd/display: Guard against setting dispclk low when active (Nicholas Kazlauskas)
- drm/amd/display: Add support for disconnected eDP streams (Harry Vanzylldejong)
- drm/amd/pm: Fetch current power limit from PMFW (Lijo Lazar)
- irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector (Anup Patel)
- eeprom: ee1004: Check chip before probing (Eddie James)
- mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs (Chris Morgan)
- i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA) (Frank Li)
- EDAC/ie31200: work around false positive build warning (Arnd Bergmann)
- power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree (Chris Morgan)
- net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [Orabug: 38095024] {CVE-2025-38061}
- wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU (Kuan-Chung Chen)
- wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware (Ping-Ke Shih)
- wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32() (Ping-Ke Shih)
- wifi: rtw89: fw: propagate error code from rtw89_h2c_tx() (Ping-Ke Shih)
- wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU (Bitterblue Smith)
- PCI: epf-mhi: Update device ID for SA8775P (Mrinmay Sarkar)
- clocksource: mips-gic-timer: Enable counter when CPUs start (Paul Burton)
- MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core (Paul Burton)
- genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (Jason Gunthorpe) [Orabug: 38095031] {CVE-2025-38062}
- x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op() (Uros Bizjak)
- drm/amdgpu: remove all KFD fences from the BO on release (Christian König)
- MIPS: Use arch specific syscall name match function (Bibo Mao)
- drm/xe/oa: Ensure that polled read returns latest data (Umesh Nerlige Ramappa)
- net: ipv6: Init tunnel link-netns before registering dev (Xiao Liang)
- crypto: skcipher - Zap type in crypto_alloc_sync_skcipher (Herbert Xu)
- crypto: ahash - Set default reqsize from ahash_alg (Herbert Xu)
- x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh)
- net/mlx5: Change POOL_NEXT_SIZE define value and make it global (Patrisious Haddad)
- scsi: scsi_debug: First fixes for tapes (Kai Mäkisara)
- dm: fix unconditional IO throttle caused by REQ_PREFLUSH (Jinliang Zheng) [Orabug: 38095038] {CVE-2025-38063}
- libbpf: Fix out-of-bound read (Nandakumar Edamana)
- loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize (Christoph Hellwig)
- net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode (Jianbo Liu)
- media: tc358746: improve calculation of the D-PHY timing registers (Matthias Fend)
- media: adv7180: Disable test-pattern control on adv7180 (Niklas Söderlund)
- cpuidle: menu: Avoid discarding useful information (Rafael J. Wysocki)
- vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines (Konstantin Shkolnyy)
- x86/nmi: Add an emergency handler in nmi_desc &amp; use it in nmi_shootdown_cpus() (Waiman Long)
- ASoC: mediatek: mt8188: Add reference for dmic clocks (Nícolas F R A Prado)
- ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile (Nícolas F R A Prado)
- drm/amd/display: Fix mismatch type comparison (Navid Assadian)
- drm/amd/display: fix dcn4x init failed (Charlene Liu)
- drm/amd/display: handle max_downscale_src_width fail check (Yihan Zhu)
- x86/build: Fix broken copy command in genimage.sh when making isoimage (Nir Lichtman)
- Octeontx2-af: RPM: Register driver with PCI subsys IDs (Hariprasad Kelam)
- bpf: Search and add kfuncs in struct_ops prologue and epilogue (Amery Hung)
- soc: ti: k3-socinfo: Do not use syscon helper to build regmap (Andrew Davis)
- wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band (Ramasamy Kaliappan)
- bonding: report duplicate MAC address in all situations (Hangbin Liu)
- net: xgene-v2: remove incorrect ACPI_PTR annotation (Arnd Bergmann)
- net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only (Eric Woudstra)
- leds: pwm-multicolor: Add check for fwnode_property_read_u32 (Yuanjun Gong)
- drm/xe: xe_gen_wa_oob: replace program_invocation_short_name (Daniel Gomez)
- drm/amdkfd: KFD release_work possible circular locking (Philip Yang)
- pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf (Inochi Amaoto)
- selftests/net: have `gro.sh -t` return a correct exit code (Kevin Krakauer)
- net/mlx5: Avoid report two health errors on same syndrome (Moshe Shemesh)
- drm/xe/pf: Create a link between PF and VF devices (K V P Satyanarayana)
- drm/xe/vf: Retry sending MMIO request to GUC on timeout error (K V P Satyanarayana)
- firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar) [Orabug: 38094925] {CVE-2025-38043}
- PCI: brcmstb: Add a softdep to MIP MSI-X driver (Stanimir Varbanov)
- PCI: brcmstb: Expand inbound window size up to 64GB (Stanimir Varbanov)
- wifi: ath12k: Report proper tx completion status to mac80211 (Vinith Kumar R)
- soc: apple: rtkit: Implement OSLog buffers properly (Hector Martin)
- soc: apple: rtkit: Use high prio work queue (Janne Grunau)
- perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters (Rob Herring)
- fpga: altera-cvp: Increase credit timeout (Kuhanh Murugasen Krishnan)
- drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence (AngeloGioacchino Del Regno)
- ARM: at91: pm: fix at91_suspend_finish for ZQ calibration (Li Bin)
- hwmon: (gpio-fan) Add missing mutex locks (Alexander Stein)
- x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Breno Leitao)
- clk: imx8mp: inform CCF of maximum frequency of clocks (Ahmad Fatoum)
- media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value (Ricardo Ribalda)
- media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map (Ricardo Ribalda)
- ublk: complete command synchronously on error (Caleb Sander)
- block: mark bounce buffering as incompatible with integrity (Christoph Hellwig)
- drm/rockchip: vop2: Add uv swap for cluster window (Andy Yan)
- ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). (Kuniyuki Iwashima)
- scsi: logging: Fix scsi_logging_level bounds (Nicolas Bouchinet)
- ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7 (Maciej S. Szmigiero)
- perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (Saket Kumar Bhaskar)
- net: pktgen: fix mpls maximum labels list parsing (Peter Seiderer)
- media: imx335: Set vblank immediately (Paul Elder)
- iommufd: Disallow allocating nested parent domain with fault ID (Yi Liu)
- ublk: enforce ublks_max only for unprivileged devices (Uday Shankar)
- dpll: Add an assertion to check freq_supported_num (Jiasheng Jiang)
- net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104 (Andrei Botila)
- net: ethernet: ti: cpsw_new: populate netdev of_node (Alexander Sverdlin)
- rcu: Fix get_state_synchronize_rcu_full() GP-start detection (Paul E. McKenney)
- pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" (Artur Weber)
- media: cx231xx: set device_caps for 417 (Hans Verkuil) [Orabug: 38094934] {CVE-2025-38044}
- perf/core: Clean up perf_try_init_event() (Peter Zijlstra)
- drm/amd/display: Request HW cursor on DCN3.2 with SubVP (Aric Cyr)
- drm/amd/display: Fix p-state type when p-state is unsupported (Dillon Varone)
- drm/amd/display: Fix DMUB reset sequence for DCN401 (Dillon Varone)
- drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination (George Shen)
- drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35 (Nicholas Kazlauskas)
- drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c (Victor Lu)
- remoteproc: qcom_wcnss: Handle platforms with only single power domain (Matti Lehtimäki)
- blk-throttle: don't take carryover for prioritized processing of metadata (Ming Lei)
- net: phylink: use pl-&gt;link_interface in phylink_expects_phy() (Choong Yong Liang)
- drm/gem: Test for imported GEM buffers with helper (Thomas Zimmermann)
- orangefs: Do not truncate file size (Matthew Wilcox) [Orabug: 38095056] {CVE-2025-38065}
- soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables (AngeloGioacchino Del Regno)
- dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [Orabug: 38095063] {CVE-2025-38066}
- usb: xhci: set page size to the xHCI-supported size (Niklas Neronin)
- media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() (Markus Elfring)
- ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 (Svyatoslav Ryhel)
- soc: samsung: include linux/array_size.h where needed (Arnd Bergmann)
- drm/xe: Retry BO allocation (Matthew Brost)
- drm/xe: Nuke VM's mapping upon close (Matthew Brost)
- ieee802154: ca8210: Use proper setters and getters for bitwise types (Andy Shevchenko)
- rtc: ds1307: stop disabling alarms on probe (Alexandre Belloni)
- tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() (Eric Dumazet)
- ALSA: seq: Improve data consistency at polling (Takashi Iwai)
- powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 (Andreas Schwab)
- arm64: tegra: Resize aperture for the IGX PCIe C5 slot (Jonathan Hunter)
- arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator (Diogo Ivo)
- drm/amdgpu: Fix missing drain retry fault the last entry (Emily Deng)
- drm/amdkfd: Set per-process flags only once cik/vi (Harish Kasiviswanathan)
- drm/amdkfd: Set per-process flags only once for gfx9/10/11/12 (Harish Kasiviswanathan)
- crypto: mxs-dcp - Only set OTP_KEY bit for OTP key (Sven Schwermer)
- crypto: lzo - Fix compression buffer overrun (Herbert Xu) [Orabug: 38095079] {CVE-2025-38068}
- misc: pci_endpoint_test: Give disabled BARs a distinct error code (Niklas Cassel)
- PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops (Christian Bruel) [Orabug: 38095087] {CVE-2025-38069}
- watchdog: aspeed: Update bootstatus handling (Chin-Ting Kuo)
- cpufreq: tegra186: Share policy per cluster (Aaron Kling)
- iommu/amd/pgtbl_v2: Improve error handling (Vasant Hegde)
- coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t (Levi Yun)
- badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable &lt; 0 (Coly Li)
- ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup() (Alexey Klimov)
- auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" (Andy Shevchenko)
- gfs2: Check for empty queue in run_queue (Andreas Gruenbacher)
- drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch (Leon Huang)
- drm/amd/display: not abort link train when bw is low (Peichen Huang)
- drm/amd/display: calculate the remain segments for all pipes (Zhikai Zhai)
- drm/amd/display: remove minimum Dispclk and apply oem panel timing. (Charlene Liu)
- ipv6: save dontfrag in cork (Willem de Bruijn)
- wifi: cfg80211: allow IR in 20 MHz configurations (Anjaneyulu)
- wifi: mac80211_hwsim: Fix MLD address translation (Ilan Peer)
- wifi: mac80211: fix warning on disconnect during failed ML reconf (Johannes Berg)
- wifi: iwlwifi: fix the ECKV UEFI variable name (Emmanuel Grumbach)
- wifi: iwlwifi: mark Br device not integrated (Johannes Berg)
- wifi: iwlwifi: fix debug actions order (Johannes Berg) [Orabug: 38094942] {CVE-2025-38045}
- wifi: iwlwifi: w/a FW SMPS mode selection (Daniel Gabay)
- wifi: iwlwifi: don't warn when if there is a FW error (Miri Korenblit)
- printk: Check CON_SUSPEND when unblanking a console (Marcos Paulo de Souza)
- iommu: Keep dev-&gt;iommu state consistent (Robin Murphy)
- hwmon: (dell-smm) Increment the number of fans (Kurt Borja)
- wifi: iwlwifi: mvm: fix setting the TK when associated (Avraham Stern)
- usb: xhci: Don't change the status of stalled TDs on failed Stop EP (Michał Pecio)
- mmc: sdhci: Disable SD card clock before changing parameters (Erick Shepherd)
- mmc: dw_mmc: add exynos7870 DW MMC support (Kaustabh Chakraborty)
- arm64/mm: Check PUD_TYPE_TABLE in pud_bad() (Ryan Roberts)
- arm64/mm: Check pmd_table() in pmd_trans_huge() (Ryan Roberts)
- phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set (Andy Yan)
- PNP: Expand length of fixup id string (Kees Cook)
- netfilter: conntrack: Bound nf_conntrack sysctl writes (Nicolas Bouchinet)
- wifi: rtw89: set force HE TB mode when connecting to 11ax AP (Dian-Syuan Yang)
- timer_list: Don't use %pK through printk() (Thomas Weißschuh)
- net: hsr: Fix PRP duplicate detection (Jaakko Karrenpalo)
- net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe (Jonas Karlman)
- posix-timers: Ensure that timer initialization is fully visible (Thomas Gleixner)
- posix-timers: Add cond_resched() to posix_timer_add() search loop (Eric Dumazet)
- RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() (Maher Sanalla)
- ext4: do not convert the unwritten extents if data writeback fails (Baokun Li)
- ext4: reject the 'data_err=abort' option in nojournal mode (Baokun Li)
- clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490 (Taniya Das)
- ASoC: sun4i-codec: support hp-det-gpios property (Ryan Walklin)
- drm/amdgpu: Update SRIOV video codec caps (David Rosca)
- drm/amdgpu/gfx11: don't read registers in mqd init (Alex Deucher)
- drm/amdgpu/gfx12: don't read registers in mqd init (Alex Deucher)
- mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check (Shree Ramamoorthy)
- pinctrl-tegra: Restore SFSEL bit when freeing pins (Prathamesh Shete)
- xen: Add support for XenServer 6.1 platform device (Frediano Ziglio)
- net/smc: use the correct ndev to find pnetid by pnetid table (Guangguan Wang)
- dm: restrict dm device size to 2^63-512 bytes (Mikulas Patocka)
- crypto: octeontx2 - suppress auth failure screaming due to negative tests (Shashank Gupta)
- kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf (Masahiro Yamada)
- kbuild: fix argument parsing in scripts/config (Seyediman Seyedarab)
- bpf: Allow pre-ordering for bpf cgroup progs (Yonghong Song)
- ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect (Nícolas F R A Prado)
- ASoC: pcm6240: Drop bogus code handling IRQ as GPIO (Linus Walleij)
- spi: spi-mux: Fix coverity issue, unchecked return value (Sergio Perez Gonzalez)
- erofs: initialize decompression early (Gao Xiang)
- thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer (Mika Westerberg)
- objtool: Fix error handling inconsistencies in check() (Josh Poimboeuf)
- rtc: rv3032: fix EERD location (Alexandre Belloni)
- tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() (Ilpo Järvinen)
- jbd2: do not try to recover wiped journal (Jan Kara)
- PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off() (Frank Li)
- bpf: Return prog btf_id without capable check (Mykyta Yatsenko)
- vfio/pci: Handle INTx IRQ_NOTCONNECTED (Alex Williamson)
- scsi: st: ERASE does not change tape location (Kai Mäkisara)
- scsi: st: Tighten the page format heuristics with MODE SELECT (Kai Mäkisara)
- hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure (Al Viro)
- ext4: reorder capability check last (Christian Göttsche)
- riscv: Call secondary mmu notifier when flushing the tlb (Alexandre Ghiti)
- bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set (Shantiprasad Shettar)
- wifi: mwifiex: Fix HT40 bandwidth issue. (Jeff Chen)
- um: Update min_low_pfn to match changes in uml_reserved (Tiwei Bie)
- um: Store full CSGSFS and SS register from mcontext (Benjamin Berg)
- clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug (Nick Hu)
- dlm: make tcp still work in multi-link env (Heming Zhao)
- s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste() (Heiko Carstens)
- i3c: master: svc: Fix missing STOP for master request (Stanley Chu)
- drm/amdgpu: adjust drm_firmware_drivers_only() handling (Alex Deucher)
- drm/amd/display: Guard against setting dispclk low for dcn31x (Jing Zhou)
- drm/amdgpu: release xcp_mgr on exit (Flora Cui)
- blk-cgroup: improve policy registration error handling (Chen Linxuan)
- btrfs: send: return -ENAMETOOLONG when attempting a path that is too long (Filipe Manana)
- btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work() (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to async workers (Filipe Manana)
- btrfs: run btrfs_error_commit_super() early (Qu Wenruo)
- btrfs: avoid linker error in btrfs_find_create_tree_block() (Mark Harmstone)
- btrfs: make btrfs_discard_workfn() block_group ref explicit (Boris Burkov)
- i2c: pxa: fix call balance of i2c-&gt;clk handling routines (Vitalii Mordan)
- i2c: qup: Vote for interconnect bandwidth to DRAM (Stephan Gerhold)
- x86/mm: Check return value from memblock_phys_alloc_range() (Philip Redkin) [Orabug: 38095101] {CVE-2025-38071}
- x86/microcode: Update the Intel processor flag scan check (Sohil Mehta)
- x86/smpboot: Fix INIT delay assignment for extended Intel Families (Sohil Mehta)
- x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP (Ingo Molnar)
- x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers (Thomas Huth)
- wifi: mt76: mt7925: fix fails to enter low power mode in suspend state (Quan Zhou)
- wifi: mt76: mt7925: load the appropriate CLC data based on hardware type (Ming Yen Hsieh)
- wifi: mt76: mt7996: revise TXS size (Benjamin Lin)
- wifi: mt76: mt7996: fix SER reset trigger on WED reset (Rex Lu)
- wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 (Felix Fietkau)
- cgroup/rstat: avoid disabling irqs for O(num_cpu) (Eric Dumazet)
- drm/amdgpu: Skip pcie_replay_count sysfs creation for VF (Victor Skvortsov)
- mmc: host: Wait for Vdd to settle on card power off (Erick Shepherd)
- staging: vchiq_arm: Create keep-alive thread during probe (Stefan Wahren)
- pidfs: improve multi-threaded exec and premature thread-group leader exit polling (Christian Brauner)
- libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [Orabug: 38095109] {CVE-2025-38072}
- ext4: on a remount, only log the ro or r/w state when it has changed (Nicolas Bretz)
- xen/pci: Do not register devices with segments &gt;= 0x10000 (Roger Pau Monné)
- PCI: vmd: Disable MSI remapping bypass under Xen (Roger Pau Monné)
- drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12 (Jonathan Kim)
- drm/amdgpu/discovery: check ip_discovery fw file available (Flora Cui)
- pNFS/flexfiles: Report ENETDOWN as a connection error (Trond Myklebust)
- tools/build: Don't pass test log files to linker (Ian Rogers)
- r8169: disable RTL8126 ZRX-DC timeout (Chunhao Lin)
- PCI: dwc: ep: Ensure proper iteration over outbound map windows (Frank Li)
- objtool: Properly disable uaccess validation (Josh Poimboeuf)
- lockdep: Fix wait context check on softirq for PREEMPT_RT (Ryo Takakura)
- dql: Fix dql-&gt;limit value when reset. (Jing Su)
- Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken (Pedro Nishiyama)
- Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal (Sean Wang)
- thermal/drivers/qoriq: Power down TMU on system suspend (Alice Guo)
- thermal/drivers/mediatek/lvts: Start sensor interrupts disabled (Nícolas F R A Prado)
- net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus (Hans-Frieder Vogt)
- net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards (Hans-Frieder Vogt)
- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (Daniel Hsu)
- ASoC: codecs: wsa883x: Correct VI sense channel mask (Krzysztof Kozlowski)
- ASoC: codecs: wsa884x: Correct VI sense channel mask (Krzysztof Kozlowski)
- spi-rockchip: Fix register out of bounds access (Luis de Arquer) [Orabug: 38095173] {CVE-2025-38081}
- SUNRPC: rpcbind should never reset the port to the value '0' (Trond Myklebust)
- SUNRPC: rpc_clnt_set_transport() must not change the autobind setting (Trond Myklebust)
- NFSv4: Treat ENETUNREACH errors as fatal for state recovery (Trond Myklebust)
- cifs: Fix establishing NetBIOS session for SMB2+ connection (Pali Rohár)
- cifs: add validation check for the fields in smb_aces (Namjae Jeon)
- cifs: Set default Netbios RFC1001 server name to hostname in UNC (Pali Rohár)
- fbdev: core: tileblit: Implement missing margin clearing for tileblit (Zsolt Kajtar)
- fbcon: Use correct erase colour for clearing in fbcon (Zsolt Kajtar)
- fbdev: fsl-diu-fb: add missing device_remove_file() (Shixiong Ou)
- riscv: Allow NOMMU kernels to access all of RAM (Samuel Holland)
- mailbox: use error ret code of of_parse_phandle_with_args() (Tudor Ambarus)
- mailbox: pcc: Use acpi_os_ioremap() instead of ioremap() (Sudeep Holla)
- tpm: Convert warn to dbg in tpm2_start_auth_session() (Jonathan Mcdowell)
- ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list (Diogo Ivo)
- tracing: Mark binary printing functions with __printf() attribute (Andy Shevchenko)
- iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability (Yi Liu)
- arm64: Add support for HIP09 Spectre-BHB mitigation (Jinqian Yang)
- SUNRPC: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFS: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Trond Myklebust)
- io_uring/msg: initialise msg request opcode (Pavel Begunkov)
- exfat: call bh_read in get_block only when necessary (Sungjong Seo)
- fuse: Return EPERM rather than ENOSYS from link() (Matt Johnston)
- smb: client: Store original IO parameters and prevent zero IO sizes (Zhaolong Wang)
- cifs: Fix negotiate retry functionality (Pali Rohár)
- cifs: Fix querying and creating MF symlinks over SMB1 (Pali Rohár)
- cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES (Pali Rohár)
- s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log (Tony Krowiak)
- x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li) [Orabug: 38094951] {CVE-2025-38047}
- kconfig: merge_config: use an empty file as initfile (Daniel Gomez)
- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (Haoran Jiang)
- bpf: fix possible endless loop in BPF map iteration (Brandon Kammerdiener)
- io_uring: don't duplicate flushing in io_req_post_cqe (Pavel Begunkov)
- block: fix race between set_blocksize and read paths (Darrick J. Wong) [Orabug: 38095117] {CVE-2025-38073}
- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (Ihor Solodrai)
- drm/amdgpu: Allow P2P access through XGMI (Felix Kuehling)
- drm/amd/display: Enable urgent latency adjustment on DCN35 (Nicholas Susanto)
- fs/ext4: use sleeping version of sb_find_get_block() (Davidlohr Bueso)
- fs/jbd2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/ocfs2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: introduce sleeping flavors for pagecache lookups (Davidlohr Bueso)
- fs/buffer: split locking for pagecache lookups (Davidlohr Bueso)
- ima: process_measurement() needlessly takes inode_lock() on MAY_READ (Frederick Lawler)
- dma-mapping: Fix warning reported for missing prototype (Balbir Singh)
- net: enetc: refactor bulk flipping of RX buffers to separate function (Vladimir Oltean)
- vhost_task: fix vhost_task_create() documentation (Stefano Garzarella)
- cgroup: Fix compilation issue due to cgroup_mutex not being exported (Gao Xu)
- dma-mapping: avoid potential unused data compilation warning (Marek Szyprowski)
- mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type (Hans de Goede)
- intel_th: avoid using deprecated page-&gt;mapping, index fields (Lorenzo Stoakes)
- dma/mapping.c: dev_dbg support for dma_addressing_limited (Balbir Singh)
- virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han) [Orabug: 38094958] {CVE-2025-38048}
- scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices (Manish Pandey)
- scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [Orabug: 38095134] {CVE-2025-38075}
- nvmem: qfprom: switch to 4-byte aligned reads (Dmitry Baryshkov)
- nvmem: core: update raw_len if the bit reading is required (Dmitry Baryshkov)
- nvmem: core: verify cell's raw_len (Dmitry Baryshkov)
- nvmem: core: fix bit offsets of more than one byte (Dmitry Baryshkov)
- nvmem: rockchip-otp: add rk3576 variant data (Heiko Stuebner)
- nvmem: rockchip-otp: Move read-offset into variant-data (Heiko Stuebner)
- cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist (Pengyu Luo)
- phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Move IRQ request in probe (Claudiu Beznea)
- i2c: designware: Fix an error handling path in i2c_dw_pci_probe() (Christophe Jaillet)
- i2c: designware: Use temporary variable for struct device (Andy Shevchenko)
- drm/amd/display: Defer BW-optimization-blocked DRR adjustments (John Olender)
- drm/amd/display: Correct timing_adjust_pending flag setting. (Zhongwei)
- drm/amd/display: Do not enable replay when vtotal update is pending. (Sung-Huai Wang)
- drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401 (Dillon Varone)
- LTS version: v6.12.30 (Jack Vogel)
- drm/amdgpu: fix pm notifier handling (Alex Deucher)
- phy: tegra: xusb: remove a stray unlock (Dan Carpenter)
- usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977018] {CVE-2025-37967}
- drm/tiny: panel-mipi-dbi: Use drm_client_setup_with_fourcc() (Fabio Estevam)
- drm/panel-mipi-dbi: Run DRM default client setup (Thomas Zimmermann)
- drm/fbdev-dma: Support struct drm_driver.fbdev_probe (Thomas Zimmermann)
- Bluetooth: btnxpuart: Fix kernel panic during FW release (Neeraj Sanjay Kale) [Orabug: 37844459] {CVE-2025-22102}
- iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977026] {CVE-2025-37968}
- accel/ivpu: Fix fw log printing (Jacek Lawrynowicz)
- accel/ivpu: Refactor functions in ivpu_fw_log.c (Jacek Lawrynowicz)
- accel/ivpu: Reset fw log on cold boot (Tomasz Rusinowicz)
- accel/ivpu: Rename ivpu_log_level to fw_log_level (Jacek Lawrynowicz)
- mm/page_alloc: fix race condition in unaccepted memory handling (Kirill A. Shutemov) [Orabug: 38094767] {CVE-2025-38008}
- drm/xe/gsc: do not flush the GSC worker from the reset path (Daniele Ceraolo Spurio)
- CIFS: New mount option for cifs.upcall namespace resolution (Ritvik Budhiraja)
- dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (Shuai Xue) [Orabug: 38094790] {CVE-2025-38014}
- dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094793] {CVE-2025-38015}
- dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call (Shuai Xue)
- dmaengine: idxd: Add missing cleanups in cleanup internals (Shuai Xue)
- dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs (Shuai Xue)
- dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy (Yemike Abhilash Chandra)
- dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094756] {CVE-2025-38005}
- mm: userfaultfd: correct dirty flags set for both present and swap pte (Barry Song)
- net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
- ring-buffer: Fix persistent buffer when commit page is the reader page (Steven Rostedt)
- wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094770] {CVE-2025-38009}
- tpm: Mask TPM RC in tpm2_start_auth_session() (Jarkko Sakkinen)
- spi: tegra114: Use value to check for invalid delays (Aaron Kling)
- smb: client: fix memory leak during error handling for POSIX mkdir (Jethro Donaldson)
- scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer (Steve Siwinski)
- phy: renesas: rcar-gen3-usb2: Set timing registers only once (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind (Claudiu Beznea)
- phy: Fix error handling in tegra_xusb_port_init (Ma Ke)
- phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking (Wayne Chang) [Orabug: 38094777] {CVE-2025-38010}
- tracing: samples: Initialize trace_array_printk() with the correct function (Steven Rostedt)
- ftrace: Fix preemption accounting for stacktrace filter command (Donglin Peng)
- ftrace: Fix preemption accounting for stacktrace trigger command (Donglin Peng)
- kbuild: Disable -Wdefault-const-init-unsafe (Nathan Chancellor)
- Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer() (Michael Kelley)
- Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (Michael Kelley)
- arm64: dts: rockchip: Remove overdrive-mode OPPs from RK3588J SoC dtsi (Dragan Simic)
- arm64: dts: amlogic: dreambox: fix missing clkc_audio node (Christian Hewitt)
- hv_netvsc: Remove rmsg_pgcnt (Michael Kelley)
- hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (Michael Kelley)
- hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (Michael Kelley)
- dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi)
- ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera (Nicolas Chauvet)
- ALSA: usb-audio: Add sample rate quirk for Audioengine D1 (Christian Heusel)
- ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() (Xu Wang)
- ACPI: PPTT: Fix processor subtable walk (Jeremy Linton)
- gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
- MAINTAINERS: Update Alexey Makhalov's email address (Alexey Makhalov)
- drm/amd/display: Avoid flooding unnecessary info messages (Wayne Lin)
- drm/amd/display: Correct the reply value when AUX write incomplete (Wayne Lin)
- drm/amdgpu: csa unmap use uninterruptible lock (Philip Yang) [Orabug: 38094779] {CVE-2025-38011}
- drm/amdgpu: fix incorrect MALL size for GFX1151 (Tim Huang)
- Revert "drm/amd/display: Hardware cursor changes color when switched to software cursor" (Melissa Wen)
- btrfs: add back warning for mount option commit values exceeding 300 (Kyoji Ogasawara)
- btrfs: fix folio leak in submit_one_async_extent() (Boris Burkov)
- btrfs: fix discard worker infinite loop after disabling discard (Filipe Manana)
- LoongArch: uprobes: Remove redundant code about resume_era (Tiezhu Yang)
- LoongArch: uprobes: Remove user_{en,dis}able_single_step() (Tiezhu Yang)
- LoongArch: Fix MAX_REG_OFFSET calculation (Huacai Chen)
- LoongArch: Save and restore CSR.CNTC for hibernation (Huacai Chen)
- LoongArch: Move __arch_cpu_idle() to .cpuidle.text section (Huacai Chen)
- LoongArch: Prevent cond_resched() occurring within kernel-fpu (Tianyang Zhang)
- HID: bpf: abort dispatch if device destroyed (Rongrong) [Orabug: 38094796] {CVE-2025-38016}
- udf: Make sure i_lenExtents is uptodate on inode eviction (Jan Kara)
- sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator (Tejun Heo) [Orabug: 38094786] {CVE-2025-38012}
- dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" (Nathan Lynch)
- NFSv4/pnfs: Reset the layout state after a layoutreturn (Trond Myklebust)
- tsnep: fix timestamping with a stacked DSA driver (Gerhard Engleder)
- net/tls: fix kernel panic when alloc_page failed (Pengtao He) [Orabug: 38094802] {CVE-2025-38018}
- mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (Ido Schimmel) [Orabug: 38094804] {CVE-2025-38019}
- wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request (Kees Cook) [Orabug: 38094788] {CVE-2025-38013}
- octeontx2-pf: Do not reallocate all ntuple filters (Subbaraya Sundeep)
- octeontx2-af: Fix CGX Receive counters (Hariprasad Kelam)
- net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability (Bc-Bocun Chen)
- octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy (Subbaraya Sundeep)
- netlink: specs: tc: all actions are indexed arrays (Jakub Kicinski)
- netlink: specs: tc: fix a couple of attribute names (Jakub Kicinski)
- drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value (Umesh Nerlige Ramappa)
- regulator: max20086: fix invalid memory access (Cosmin Tanislav) [Orabug: 38094833] {CVE-2025-38027}
- qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() (Abdun Nihaal)
- net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094808] {CVE-2025-38020}
- vsock/test: Fix occasional failure in SIOCOUTQ tests (Konstantin Shkolnyy)
- net: dsa: b53: prevent standalone from trying to forward to other ports (Jonas Gorski)
- ALSA: sh: SND_AICA should depend on SH_DMA_API (Geert Uytterhoeven)
- nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (Keith Busch)
- nvme-pci: make nvme_pci_npages_prp() __always_inline (Kees Cook)
- net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING (Vladimir Oltean)
- net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe)
- ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info (Takashi Iwai)
- ALSA: seq: Fix delivery of UMP events to group ports (Takashi Iwai)
- net: mctp: Ensure keys maintain only one ref to corresponding dev (Andrew Jeffery)
- tests/ncdevmem: Fix double-free of queue array (Cosmin Ratiu)
- selftests: ncdevmem: Switch to AF_INET6 (Stanislav Fomichev)
- selftests: ncdevmem: Make client_ip optional (Stanislav Fomichev)
- selftests: ncdevmem: Unify error handling (Stanislav Fomichev)
- selftests: ncdevmem: Separate out dmabuf provider (Stanislav Fomichev)
- selftests: ncdevmem: Redirect all non-payload output to stderr (Stanislav Fomichev)
- net: mctp: Don't access ifa_index when missing (Matt Johnston)
- mctp: no longer rely on net-&gt;dev_index_head[] (Eric Dumazet)
- tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing (Hangbin Liu)
- net_sched: Flush gso_skb list too during -&gt;change() (Cong Wang) [Orabug: 37998128] {CVE-2025-37992}
- Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags (Luiz Augusto von Dentz)
- RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Zhu Yanjun) [Orabug: 38094813] {CVE-2025-38022}
- spi: loopback-test: Do not split 1024-byte hexdumps (Geert Uytterhoeven)
- nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094818] {CVE-2025-38023}
- HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 38094764] {CVE-2025-38007}
- HID: thrustmaster: fix memory leak in thrustmaster_interrupts() (Qasim Ijaz)
- RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094827] {CVE-2025-38024}
- virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx (Koichiro Den)
- virtio_ring: add a func argument 'recycle_done' to virtqueue_reset() (Koichiro Den)
- iio: chemical: sps30: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7768-1: Fix insufficient alignment of timestamp. (Jonathan Cameron)
- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
- xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
- Revert "drm/amd: Stop evicting resources on APUs in suspend" (Alex Deucher)
- drm/amd: Add Suspend/Hibernate notification callback support (Mario Limonciello)
- iio: pressure: mprls0025pa: use aligned_s64 for timestamp (David Lechner)
- iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7266: Fix potential timestamp alignment issue. (Jonathan Cameron)
- KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (Sean Christopherson)
- KVM: Add member to struct kvm_gfn_range to indicate private/shared (Isaku Yamahata)
- uio_hv_generic: Fix sysfs creation path for ring buffer (Naman Jain)
- tpm: tis: Double the timeout B to 4s (Michal Suchanek)
- tracing: probes: Fix a possible race in trace_probe_log APIs (Masami Hiramatsu)
- cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks (Waiman Long)
- arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout (Himanshu Bhavani)
- platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection (Hans de Goede)
- platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL) (Runhua He)
- binfmt_elf: Move brk for static PIE even if ASLR disabled (Kees Cook)
- riscv: dts: sophgo: fix DMA data-width configuration for CV18xx (Ze Huang)
- drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies (Mario Limonciello)
- drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC Policies (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list to always include security.* xattrs (Stephen Smalley)
- arm64: dts: rockchip: Assign RT5616 MCLK rate on rk3588-friendlyelec-cm3588 (Tom Vincent)
- LTS version: v6.12.29 (Jack Vogel)
- arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977004] {CVE-2025-37963}
- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976926] {CVE-2025-37948}
- arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
- arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
- arm64: insn: Add support for encoding DSB (James Morse)
- mm: page_alloc: speed up fallbacks in rmqueue_bulk() (Johannes Weiner)
- mm: page_alloc: don't steal single pages from biggest buddy (Johannes Weiner)
- Bluetooth: btmtk: Remove the resetting step before downloading the fw (Hao Qin)
- Bluetooth: btmtk: Remove resetting mt7921 before downloading the fw (Hao Qin)
- io_uring: always arm linked timeouts prior to issue (Jens Axboe)
- rust: clean Rust 1.88.0's `clippy::uninlined_format_args` lint (Miguel Ojeda)
- rust: allow Rust 1.87.0's `clippy::ptr_eq` lint (Miguel Ojeda)
- Revert "um: work around sched_yield not yielding in time-travel mode" (Christian Lamparter)
- do_umount(): add missing barrier before refcount checks in sync case (Al Viro)
- io_uring/sqpoll: Increase task_work submission batch size (Gabriel Krisman Bertazi)
- drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs (Tejas Upadhyay)
- drm/xe/tests/mocs: Update xe_force_wake_get() return handling (Himal Prasad Ghimiray)
- riscv: misaligned: enable IRQs while handling misaligned accesses (Clément Léger)
- riscv: misaligned: factorize trap handling (Clément Léger)
- nvme: unblock ctrl state transition for firmware update (Daniel Wagner)
- drm/panel: simple: Update timings for AUO G101EVN010 (Kevin Baker)
- loop: Add sanity check for read/write_iter (Lizhi Xu)
- loop: factor out a loop_assign_backing_file helper (Christoph Hellwig)
- loop: refactor queue limits updates (Christoph Hellwig)
- loop: Fix ABBA locking race (Ogawa Hirofumi)
- loop: Simplify discard granularity calc (John Garry)
- loop: Use bdev limit helpers for configuring discard (John Garry)
- riscv: misaligned: Add handling for ZCB instructions (Nylon Chen)
- MIPS: Fix MAX_REG_OFFSET (Thorsten Blum)
- iio: adc: dln2: Use aligned_s64 for timestamp (Jonathan Cameron)
- iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64 (Jonathan Cameron)
- types: Complement the aligned types with signed 64-bit one (Andy Shevchenko)
- iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer. (Jonathan Cameron)
- iio: accel: adxl367: fix setting odr for activity time update (Lothar Rubusch)
- usb: usbtmc: Fix erroneous generic_read ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous wait_srq ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous get_stb ioctl error returns (Dave Penkler)
- USB: usbtmc: use interruptible sleep in usbtmc_read (Oliver Neukum)
- usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015126] {CVE-2025-37994}
- usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition (Rd Babiera)
- usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs (Lukasz Czechowski)
- usb: host: tegra: Prevent host controller crash when OTG port is used (Jim Lin)
- usb: gadget: Use get_status callback to set remote wakeup capability (Prashanth K)
- usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN (Wayne Chang)
- usb: gadget: f_ecm: Add get_status callback (Prashanth K)
- usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version (Pawel Laszczak)
- usb: cdnsp: Fix issue with resuming from L1 (Pawel Laszczak)
- usb: dwc3: gadget: Make gadget_wakeup asynchronous (Prashanth K)
- x86/microcode: Consolidate the loader enablement checking (Borislav Petkov)
- module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015131] {CVE-2025-37995}
- memblock: Accept allocated memory before use in memblock_double_array() (Tom Lendacky) [Orabug: 37976994] {CVE-2025-37960}
- clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() (Sebastian Andrzej Siewior)
- arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong idmap generation (Levi Yun)
- accel/ivpu: Increase state dump msg timeout (Jacek Lawrynowicz)
- xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976934] {CVE-2025-37949}
- xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it (John Ernberg)
- smb: client: Avoid race in open_cached_dir with lease breaks (Paul Aurich) [Orabug: 37976959] {CVE-2025-37954}
- usb: uhci-platform: Make the clock really optional (Alexey Charkov)
- drm/amdgpu/hdp7: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amd/display: Copy AUX read reply data whenever length &gt; 0 (Wayne Lin)
- drm/amd/display: Fix wrong handling for AUX_DEFER case (Wayne Lin)
- drm/amd/display: Remove incorrect checking in dmub aux handler (Wayne Lin)
- drm/amd/display: Fix the checking condition in dmub aux handling (Wayne Lin)
- drm/amd/display: more liberal vmin/vmax update for freesync (Aurabindo Pillai)
- drm/amd/display: Fix invalid context error in dml helper (Roman Li) [Orabug: 37977185] {CVE-2025-37965}
- drm/amdgpu/vcn: using separate VCN1_AON_SOC offset (Ruijing Dong)
- drm/xe: Add page queue multiplier (Matthew Brost)
- drm/v3d: Add job to pending list if the reset was skipped (Maíra Canal) [Orabug: 37976942] {CVE-2025-37951}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug: 37977031] {CVE-2025-37969}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977037] {CVE-2025-37970}
- iio: imu: inv_mpu6050: align buffer for timestamp (David Lechner)
- iio: adis16201: Correct inclinometer channel resolution (Gabriel)
- iio: adc: rockchip: Fix clock initialization sequence (Simon Xue)
- iio: adc: ad7606: fix serial register access (Angelo Dureghello)
- io_uring: ensure deferred completions are flushed for multishot (Jens Axboe)
- drm/amd/display: Shift DMUB AUX reply command if necessary (Wayne Lin)
- KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (Mikhail Lobanov) [Orabug: 37976977] {CVE-2025-37957}
- selftests/mm: fix a build failure on powerpc (Nysal Jan K.A.)
- selftests/mm: compaction_test: support platform with huge mount of memory (Feng Tang)
- mm/userfaultfd: fix uninitialized output field for -EAGAIN race (Peter Xu)
- mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976982] {CVE-2025-37958}
- mm: fix folio_pte_batch() on XEN PV (Petr Vaněk)
- x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (Dave Hansen) [Orabug: 37977013] {CVE-2025-37964}
- staging: axis-fifo: Correct handling of tx_fifo_depth for size validation (Gabriel)
- staging: axis-fifo: Remove hardware resets for user errors (Gabriel)
- staging: bcm2835-camera: Initialise dev in v4l2_dev (Dave Stevenson) [Orabug: 37977042] {CVE-2025-37971}
- staging: iio: adc: ad7816: Correct conditional logic for store mode (Gabriel)
- rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.87.0 (Miguel Ojeda)
- rust: clean Rust 1.88.0's `unnecessary_transmutes` lint (Miguel Ojeda)
- Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 (Aditya Garg)
- Input: synaptics - enable SMBus for HP Elitebook 850 G1 (Dmitry Torokhov)
- Input: synaptics - enable InterTouch on Dell Precision M3800 (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30L-G (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30-D (Manuel Fombuena)
- Input: xpad - fix two controller table values (Vicki Pfau)
- Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller (Lode Willems)
- Input: xpad - fix Share button on Xbox One controllers (Vicki Pfau)
- Input: mtk-pmic-keys - fix possible null pointer dereference (Gary Bisson) [Orabug: 37977044] {CVE-2025-37972}
- Input: cyttsp5 - fix power control issue on wakeup (Mikael Gonella-Bolduc)
- Input: cyttsp5 - ensure minimum reset pulse width (Hugo Villeneuve)
- virtio-net: fix total qstat values (Jakub Kicinski)
- net: export a helper for adding up queue stats (Jakub Kicinski)
- fbnic: Do not allow mailbox to toggle to ready outside fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Pull fbnic_fw_xmit_cap_msg use out of interrupt context (Alexander Duyck)
- fbnic: Improve responsiveness of fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Actually flush_tx instead of stalling out (Alexander Duyck)
- fbnic: Gate AXI read/write enabling on FW mailbox (Alexander Duyck)
- fbnic: Fix initialization of mailbox descriptor rings (Alexander Duyck)
- net: dsa: b53: do not set learning and unicast/multicast on up (Jonas Gorski)
- net: dsa: b53: fix learning on VLAN unaware bridges (Jonas Gorski)
- net: dsa: b53: fix toggling vlan_filtering (Jonas Gorski)
- net: dsa: b53: do not program vlans when vlan filtering is off (Jonas Gorski)
- net: dsa: b53: do not allow to configure VLAN 0 (Jonas Gorski)
- net: dsa: b53: always rejoin default untagged VLAN on bridge leave (Jonas Gorski)
- net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave (Jonas Gorski)
- net: dsa: b53: fix flushing old pvid VLAN on pvid change (Jonas Gorski)
- net: dsa: b53: fix clearing PVID of a port (Jonas Gorski)
- net: dsa: b53: keep CPU port always tagged again (Jonas Gorski)
- net: dsa: b53: allow leaky reserved multicast (Jonas Gorski)
- bpf: Scrub packet on bpf_redirect_peer (Paul Chaignon) [Orabug: 37976990] {CVE-2025-37959}
- netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015141] {CVE-2025-37997}
- ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [Orabug: 37976996] {CVE-2025-37961}
- erofs: ensure the extra temporary copy is valid for shortened bvecs (Gao Xiang)
- ice: use DSN instead of PCI BDF for ice_adapter index (Przemek Kitszel)
- ice: Initial support for E825C hardware in ice_adapter (Sergey Temerkhanov)
- wifi: mac80211: fix the type of status_code for negotiated TID to Link Mapping (Michael-Cy Lee)
- can: gw: fix RCU/BH usage in cgw_create_job() (Oliver Hartkopp)
- can: mcp251xfd: fix TDC setting for low data bit rates (Kelsey Maes)
- can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe (Antonios Salios) [Orabug: 38015123] {CVE-2025-37993}
- net: ethernet: mtk_eth_soc: do not reset PSE when setting FE (Frank Wunderlich)
- net: ethernet: mtk_eth_soc: reset all TX queues on DMA free (Daniel Golle)
- gre: Fix again IPv6 link-local address generation. (Guillaume Nault)
- virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (Jakub Kicinski) [Orabug: 37976969] {CVE-2025-37955}
- virtio_net: xsk: bind/unbind xsk for tx (Xuan Zhuo)
- sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 37977176] {CVE-2025-37953}
- s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
- ksmbd: fix memory leak in parse_lease_state() (Zhaolong Wang) [Orabug: 37977180] {CVE-2025-37962}
- openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015148] {CVE-2025-37998}
- ksmbd: Fix UAF in __close_file_table_ids (Sean Heelan) [Orabug: 37976951] {CVE-2025-37952}
- ksmbd: prevent out-of-bounds stream writes by validating *pos (Norbert Szetei) [Orabug: 37976923] {CVE-2025-37947}
- ksmbd: prevent rename with empty string (Namjae Jeon) [Orabug: 37976972] {CVE-2025-37956}
- can: rockchip_canfd: rkcanfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Niklas Schnelle) [Orabug: 37976920] {CVE-2025-37946}
- vfio/pci: Align huge faults to order (Alex Williamson)
- wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation (Veerendranath Jakkam) [Orabug: 37977046] {CVE-2025-37973}
- s390/pci: Fix missing check for zpci_create_device() error return (Niklas Schnelle) [Orabug: 37977050] {CVE-2025-37974}
- can: mcan: m_can_class_unregister(): fix order of unregistration calls (Marc Kleine-Budde)
- firmware: arm_scmi: Fix timeout checks on polling path (Cristian Marussi)
- arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2 (Wojciech Dubowik)
- Revert "btrfs: canonicalize the device path before adding it" (Qu Wenruo)
- fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (Max Kellermann) [Orabug: 38015155] {CVE-2025-37999}
- dm: add missing unlock on in dm_keyslot_evict() (Dan Carpenter)
- mm/vmscan: wake up flushers conditionally to avoid cgroup OOM (Zeng Jingxiang) [Orabug: 37480932]
- dmaengine: idxd: Narrow the restriction on BATCH to ver. 1 only (Vinicius Costa Gomes) [Orabug: 37801355]
- uek-rpm: build the fwctl mlx5 driver on UEK (Qing Huang) [Orabug: 37810636]
- fwctl: Adapt upstream code for UEK8 (Mikhael Goikhman) [Orabug: 37810636]
- mlx5: Create an auxiliary device for fwctl_mlx5 (Saeed Mahameed) [Orabug: 37810636]
- fwctl/mlx5: Support for communicating with mlx5 fw (Saeed Mahameed) [Orabug: 37810636]
- fwctl: Add documentation (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware (Jason Gunthorpe) [Orabug: 37810636]
- taint: Add TAINT_FWCTL (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_INFO to return basic information about the device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Basic ioctl dispatch for the character device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Add basic structure for a class subsystem with a cdev (Jason Gunthorpe) [Orabug: 37810636]
- Revert "fwctl: Add basic structure for a class subsystem with a cdev" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Basic ioctl dispatch for the character device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_INFO to return basic information about the device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Support for communicating with mlx5 fw" (Qing Huang) [Orabug: 37810636]
- Revert "mlx5: Create an auxiliary device for fwctl_mlx5" (Qing Huang) [Orabug: 37810636]
- Revert "taint: Add TAINT_FWCTL" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Adapt code for UEK-NEXT" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Add INTERNAL_DEV_RES uctx capability" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Allow up to 4k devices" (Qing Huang) [Orabug: 37810636]
- Revert "uek-rpm: build the fwctl mlx5 driver on UEK" (Qing Huang) [Orabug: 37810636]
- dmaengine: idxd: Change err messages to dbg (Jack Vogel) [Orabug: 37841831]
- PCI: Add PCI_VDEVICE_SUB helper macro (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbevf: Add support for Intel(R) E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Enable link management in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Clean up the E610 link management related code (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add ixgbe_x540 multiple header inclusion protection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for EEPROM dump in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for NVM handling in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add link management support for E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 device capabilities detection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 FW Admin Command Interface (Piotr Kwapulinski) [Orabug: 37889575]
- uek-rpm: Move the gve kernel module from extra to kernel-uek-core (Samasth Norway Ananda) [Orabug: 37940897]
- uek-rpm/config-aarch64: Enable BT_HCIUART_BCM for RPi Bluetooth (Vijay Kumar) [Orabug: 37961540]
- platform/mellanox: mlxbf-pmc: Support additional PMC blocks (Shravan Kumar Ramani) [Orabug: 37964051]
- mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug: 37964051,38037120] {CVE-2025-37866}
- mlxbf-bootctl: Support sysfs entries for RTC battery status (Xiangrong Li) [Orabug: 37964051]
- platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37964051]
- uek-rpm: CONFIG_PTP_1588_CLOCK_OCP enable for OCI (Vijayendra Suman) [Orabug: 37966384]
- x86/its: Fix build errors when CONFIG_MODULES=n (Eric Biggers) [Orabug: 37970148]
- x86/its: Use dynamic thunks for indirect branches (Peter Zijlstra) [Orabug: 37970148]
- x86/ibt: Keep IBT disabled during alternative patching (Pawan Gupta) [Orabug: 37970148]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 37989268]
- amd_hsmp: Increase the SMU timeout to 500ms (Vijay Kumar) [Orabug: 38000074]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge)  [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang)  [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming)  [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams)  [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson)  [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley)  [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson)  [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson)  [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang)  [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang)  [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang)  [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang)  [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang)  [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang)  [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie)  [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie)  [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen)  [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen)  [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda)  [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda)  [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.1.el10uek]" date="1750939200">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.2.el10uek]" date="1752148800">- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38178286]  {CVE-2025-38089}
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38162790]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38175263]
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)  [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)  [Orabug: 38175246]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.3.el10uek]" date="1752494400">- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38171405]</changelog>
</package>
<package pkgid="3e288e9d1557fed8a46601e4d73f948301cbc704" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="102.36.5.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge) [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang) [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming) [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams) [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson) [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley) [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson) [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson) [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang) [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang) [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang) [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang) [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang) [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang) [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie) [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie) [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen) [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen) [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda) [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda) [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger)  [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan)  [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan)  [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin)
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota)
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu)
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng)
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann)
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo)
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov)
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu)
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi)
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung)
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei Zhang)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Wentao Liang)
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold)
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-ji Chen)
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu)
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett)
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana)
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li (Intel))
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells)
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara)
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko)
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima)
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai)
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee)
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima)
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet)
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer)
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai)
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin)
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (SeongJae Park)
- smb: client: remove 	 from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima)
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski)
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev)
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo)
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski)
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang)
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin.Cao)
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng)
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke)
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun)
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (FUJITA Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin KaFai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu)
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra)
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher)
- smb: client: fix first command failure during re-negotiation (zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich)
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet)
- net: atm: add lec_mutex (Eric Dumazet)
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima)
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg)
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev)
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski)
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu)
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima)
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima)
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov)
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo)
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh AP)
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon)
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka)
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders)
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sá)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott)
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath SM)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal)
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn)
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis)
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam)
- Input: sparcspkr - avoid unannotated fall-through (WangYuli)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar)
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima)
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rong Zhang)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon)
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li (Intel))
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski)
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet)
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath SM)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin)
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov)
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang)
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton)
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes)
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook)
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Wentao Liang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij)
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo)
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner)
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu)
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh AP)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso)
- f2fs: fix to bail out in get_new_segment() (Chao Yu)
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski)
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R)
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin)
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao)
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S)
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (gldrk)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han)
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han)
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn)
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos)
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang)
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang)
- regulator: max14577: Add error check for max14577_read_reg() (Wentao Liang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel Shahrouzi)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann)
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz)
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin)
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Wentao Liang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Wentao Liang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams)
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'ichiro Kawasaki)
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park)
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (GONG Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu)
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim)
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski)
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han)
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu)
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim)
- f2fs: fix to do sanity check on ino and xnid (Chao Yu)
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter)
- ext4: only dirty folios when data journaling regular files (Brian Foster)
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo)
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis)
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko)
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin)
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeff Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar)
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski)
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian)
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev)
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis)
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li)
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Wentao Liang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis)
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park)
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann)
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng)
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (NeilBrown)
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh)
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter)
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Wentao Liang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Wentao Liang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Wentao Liang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F. R. A. Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li (Intel))
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner)
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov)
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt)
- 9p: Add a migrate_folio method (Matthew Wilcox (Oracle))
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (RD Babiera)
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby (SUSE))
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Wupeng Ma)
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard)
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov)
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge)
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox (Oracle))
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox (Oracle))
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig)
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang)
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana)
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski)
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet)
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet)
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet)
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin)
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz)
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski)
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski)
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj)
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui)
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani (IBM))
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet)
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang)
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park)
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz)
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav)
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold)
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro)
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki NAGAO)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski)
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel)
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal)
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari)
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song)
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng)
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré)
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré)
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak)
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas)
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen)
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Yeoreum Yun)
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz)
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (WangYuli)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang)
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin)
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar)
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin)
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang)
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng)
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe JAILLET)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe JAILLET)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski)
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin)
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov)
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin)
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov)
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin)
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei)
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Wentao Liang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher)
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F. R. A. Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo)
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima)
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam)
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur)
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang)
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (KaFai Wan)
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein)
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich)
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen)
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook)
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li RongQing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin)
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin)
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný)
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (ping.gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen)
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu)
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu)
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev)
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring (Arm))
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen)
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko)
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin)
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (YiFei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad)
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso)
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang)
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan)
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma)
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen XIN)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen XIN)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu)
- f2fs: prevent the current section from being selected as a victim during GC (yohan.joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter)
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu)
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen)
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen)
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang)
- xen/x86: fix initial memory balloon target (Roger Pau Monne)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon)
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A. R. Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin)
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe JAILLET)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao)
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao)
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland)
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown)
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han)
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian)
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo)
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot)
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong)
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu)
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F. R. A. Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu (Google))
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby (SUSE))
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait)
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper)
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli)  [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha)  [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137447]  {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky)  [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli)  [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly)  [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry)  [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson)  [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson)  [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry)  [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry)  [Orabug: 38026089]
- xfs: update atomic write limits (John Garry)  [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry)  [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry)  [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry)  [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry)  [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry)  [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong)  [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong)  [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry)  [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong)  [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry)  [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong)  [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong)  [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig)  [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig)  [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry)  [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry)  [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry)  [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry)  [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry)  [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry)  [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry)  [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry)  [Orabug: 38026089]
- dm-table: atomic writes support (John Garry)  [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry)  [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry)  [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry)  [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry)  [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry)  [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry)  [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry)  [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry)  [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry)  [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry)  [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry)  [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry)  [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry)  [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry)  [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry)  [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry)  [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen)  [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge)  [Orabug: 38137957]
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge)  [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge)  [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna)  [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju)  [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.1.el10uek]" date="1754481600">- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann)  [Orabug: 38217337]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.2.el10uek]" date="1755086400">- iommu/vt-d: Fix misplaced domain_attached assignment (Ban ZuoXiang)  [Orabug: 38294635]</changelog>
</package>
<package pkgid="18af16c499c8fe2563228ce2e588a34a833191dd" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger) [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo) [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan) [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan) [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
</package>
<package pkgid="4f9afaecbe7a5729ede8f99d43f020529acf591d" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]  
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
</package>
<package pkgid="0df521d1184c71088b1661c86a263bf395c0f7a9" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560} 
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500} 
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566} 
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571} 
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618} 
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
</package>
<package pkgid="ea2c4faf155e5cbcd4435ff8f9e40538513b0c10" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560}
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500}
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566}
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571}
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618}
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.4.el10uek]" date="1759492800">- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton)  [Orabug: 38500610]  {CVE-2025-38724} 
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38500621]  {CVE-2025-39698} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38500629]  {CVE-2025-39881} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38500632]  {CVE-2025-39866}</changelog>
</package>
<package pkgid="e4432693c01b42632a54b487280f476e45718b29" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="104.43.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
</package>
<package pkgid="a83bf5741ed6bdc3e2a7f1b799e52a4b201c0dc5" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="104.43.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.3.el10uek]" date="1761220800">- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38572958]  {CVE-2025-39698} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38572953]  {CVE-2025-39866} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38572951]  {CVE-2025-3988} 
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon)  [Orabug: 38572950]  {CVE-2025-39718} 
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38572948]  {CVE-2025-39964} 
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)  [Orabug: 38572947]  {CVE-2025-39963} 
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)  [Orabug: 38572946]  {CVE-2025-39965} 
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski)  [Orabug: 38572944]  {CVE-2025-39946} 
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)  [Orabug: 38572943]  {CVE-2025-39977} 
- i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38572941]  {CVE-2025-39973}</changelog>
</package>
<package pkgid="f9f39ec47679973373cb0370e1d17c55a49e9a14" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="105.51.5.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)
- media: rc: fix races with imon_disconnect() (Larshin Sergey)
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik)
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)
- i40e: add validation for ring_len param (Lukasz Czapnik)
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.1.el10uek]" date="1764590400">- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu)  [Orabug: 38712788]  {CVE-2025-40019} 
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712786]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="5c6c2d310254c2c1f0905b456693017309dd03b7" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="105.51.5.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]  
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]  
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]  
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]  
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]  
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]  
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]  
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]  
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]  
- LTS version: v6.12.51 (Jack Vogel)   
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)   
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)   
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)   
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)   
- media: rc: fix races with imon_disconnect() (Larshin Sergey)   
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)   
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)   
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)   
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)   
- crypto: sha256 - fix crash at kexec (Breno Leitao)   
- LTS version v6.12.50 (Jack Vogel)   
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)   
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)   
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)   
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)   
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)   
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)   
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)   
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)   
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)   
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)   
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)   
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)   
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)   
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)   
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))   
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)   
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)   
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)   
- i40e: add max boundary check for VF filters (Lukasz Czapnik)   
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)   
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)   
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)   
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)   
- i40e: add validation for ring_len param (Lukasz Czapnik)   
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)   
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)   
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)   
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)   
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)   
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)   
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)   
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)   
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)   
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)   
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)   
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)   
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)   
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)   
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)   
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)   
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)   
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)   
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)   
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)   
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)   
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)   
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)   
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)   
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)   
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)   
- wifi: virt_wifi: Fix page fault on connect (James Guan)   
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)   
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)   
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)   
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)   
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)   
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)   
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)   
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)   
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)   
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)   
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)   
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)   
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)   
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)   
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)   
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)   
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)   
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)   
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)   
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)   
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)   
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)   
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)   
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)   
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)   
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
</package>
<package pkgid="7f9e35ac404390fc7c4512db28607dbee427b1f5" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="106.55.4.1.el10uek"/>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="11f5860aa339dbeca089b379a2103f64824b84c4" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="106.55.4.2.el10uek"/>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.2.el10uek]" date="1766145600">- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)   {CVE-2025-40271} 
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="8803d75f1860424732dfaf5cad581c477cb514b4" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="c70d99687c5e7854933b87d101dbd014d1fa0566" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
</package>
<package pkgid="0b81f85468969b257497f315eaaeaa945d012679" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.4.el10uek]" date="1770292800">- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet)  [Orabug: 38932996]  {CVE-2025-40257} 
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38932973]  {CVE-2025-40149} 
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet)  [Orabug: 38932955]  {CVE-2025-40258} 
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38932939]</changelog>
</package>
<package pkgid="75fe6953184a7642030f7371936d9055e8f6afcd" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="108.64.6.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge) [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp) [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal) [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.62.1.el10uek]" date="1765886400">- uek-rpm: Allow disabling kabichk at command line (Yifei Liu) [Orabug: 38733049]
- Revert "xfrm: Use xdo.dev instead of xdo.real_dev" (Jack Vogel) [Orabug: 38718730]
- Revert "net/mlx5: Fix IPsec cleanup over MPV device" (Jack Vogel) [Orabug: 38718730]
- LTS version: v6.12.62 (Jack Vogel)
- bus: mhi: host: pci_generic: Add Telit FN990B40 modem support (Daniele Palmas)
- bus: mhi: host: pci_generic: Add Telit FN920C04 modem support (Daniele Palmas)
- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (Navaneeth K)
- staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (Navaneeth K)
- staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (Navaneeth K)
- comedi: check device's attached status in compat ioctls (Nikita Zhandarovich)
- comedi: multiq3: sanitize config options in multiq3_attach() (Nikita Zhandarovich)
- comedi: c6xdigio: Fix invalid PNP driver unregistration (Ian Abbott)
- wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (Zenm Chen)
- wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1 (Zenm Chen)
- samples: work around glibc redefining some of our defines wrong (Linus Torvalds)
- LoongArch: Mask all interrupts during kexec/kdump (Huacai Chen)
- HID: elecom: Add support for ELECOM M-XT3URBK (018F) (Naoki Ueki)
- platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (Antheas Kapenekakis)
- platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (Antheas Kapenekakis)
- platform/x86: huawei-wmi: add keys for HONOR models (Ston Jia)
- HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (April Grimoire)
- platform/x86: acer-wmi: Ignore backlight event (Armin Wolf)
- pinctrl: qcom: msm: Fix deadlock in pinmux configuration (Praveen Talari)
- nvme: fix admin request_queue lifetime (Keith Busch) [Orabug: 38773611] {CVE-2025-68265}
- HID: hid-input: Extend Elan ignore battery quirk to USB (Mario Limonciello)
- bfs: Reconstruct file type when loading from disk (Tetsuo Handa)
- ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (Lushih Hsieh)
- drm/amdkfd: Fix GPU mappings for APU after prefetch (Harish Kasiviswanathan)
- smb: fix invalid username check in smb3_fs_context_parse_param() (Yiqi Sun)
- Bluetooth: btrtl: Avoid loading the config file on security chips (Max Chou)
- drm/vmwgfx: Use kref in vmw_bo_dirty (Ian Forbes)
- spi: imx: keep dma request disabled before dma transfer setup (Robin Gong)
- spi: xilinx: increase number of retries before declaring stall (Alvaro Gamez Machado)
- ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() (Song Liu)
- USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- serial: add support of CPCI cards (Magne Bruno)
- USB: serial: ftdi_sio: match on interface number for jtag (Johan Hovold)
- USB: serial: option: move Telit 0x10c7 composition in the right place (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FE910C04 new compositions (Fabio Porcedda)
- USB: serial: option: add Foxconn T99W760 (Slark Xiao)
- KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (Omar Sandoval) [Orabug: 38773578] {CVE-2025-68259}
- comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (Nikita Zhandarovich)
- ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (Alexey Nepomnyashih) [Orabug: 38773586] {CVE-2025-68261}
- locking/spinlock/debug: Fix data-race in do_raw_write_lock (Alexander Sverdlin)
- ksmbd: ipc: fix use-after-free in ipc_msg_send_request (Qianchang Zhao)
- ext4: refresh inline data size before write operations (Deepanshu Kartikey) [Orabug: 38773602] {CVE-2025-68264}
- jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (Ye Bin) [Orabug: 38792632] {CVE-2025-68337}
- Documentation: process: Also mention Sasha Levin as stable tree maintainer (Bagas Sanjaya)
- xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca)
- xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)
- Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca)
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca) [Orabug: 38730491,38854317] {CVE-2025-40215}
- LTS version: v6.12.61 (Jack Vogel)
- spi: spi-nxp-fspi: Check return value of devm_mutex_init() (Thomas Weißschuh)
- drm/i915/dp: Initialize the source OUI write timestamp always (Imre Deak)
- Revert "ACPI: Suppress misleading SPCR console message when SPCR table is absent" (Punit Agrawal)
- wifi: ath12k: correctly handle mcast packets for clients (Sarika Sharma)
- net: dsa: microchip: Free previously initialized ports on init failures (Bastien Curutchet)
- net: dsa: microchip: Do not execute PTP driver code for unsupported switches (Tristram Ha)
- drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (Thomas Zimmermann) [Orabug: 38773709] {CVE-2025-68296}
- net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() (Bastien Curutchet)
- KVM: SVM: Fix redundant updates of LBR MSR intercepts (Yosry Ahmed)
- KVM: nSVM: Fix and simplify LBR virtualization handling with nested (Yosry Ahmed)
- KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() (Yosry Ahmed)
- KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts() (Yosry Ahmed)
- mm/huge_memory: fix NULL pointer deference when splitting folio (Wei Yang) [Orabug: 38773700] {CVE-2025-68293}
- usb: gadget: udc: fix use-after-free in usb_gadget_state_work (Jimmy Hu) [Orabug: 38773635] {CVE-2025-68282}
- usb: udc: Add trace event for usb_gadget_set_state (Kuen-Han Tsai)
- can: rcar_canfd: Fix CAN-FD mode as default (Biju Das)
- usb: typec: ucsi: psy: Set max current to zero when disconnected (Jameson Thies)
- nfsd: Replace clamp_t in nfsd4_get_drc_mem() (Neil Brown)
- staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann)
- libceph: replace BUG_ON with bounds check for map-&gt;max_osd (Ziming Zhang) [Orabug: 38773641] {CVE-2025-68283}
- libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773648] {CVE-2025-68284}
- libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773654] {CVE-2025-68285}
- net: dsa: microchip: Don't free uninitialized ksz_irq (Bastien Curutchet)
- net: dsa: microchip: ptp: Fix checks on irq_find_mapping() (Bastien Curutchet)
- net: dsa: microchip: common: Fix checks on irq_find_mapping() (Bastien Curutchet)
- drm/amd/display: Don't change brightness for disabled connectors (Mario Limonciello)
- drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773661] {CVE-2025-68286}
- drm/amd/amdgpu: reserve vm invalidation engine for uni_mes (Michael Chen)
- drm: sti: fix device leaks at component probe (Johan Hovold)
- USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang)
- USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov)
- xhci: dbgtty: fix device unregister (Łukasz Bartosik)
- xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman)
- xhci: fix stale flag preventig URBs after link state error is cleared (Mathias Nyman)
- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar)
- usb: dwc3: pci: Sort out the Intel device IDs (Krogerus Heikki)
- usb: dwc3: pci: add support for the Intel Nova Lake -S (Krogerus Heikki)
- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792592] {CVE-2025-68331}
- usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762728] {CVE-2025-40345}
- USB: storage: Remove subclass and protocol overrides from Novatek quirk (Alan Stern)
- usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773676] {CVE-2018-1000204,CVE-2025-68288}
- usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea)
- usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai)
- usb: cdns3: Fix double resource release in cdns3_pci_probe (Miaoqian Lin)
- most: usb: fix double free on late probe failure (Johan Hovold)
- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin)
- mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). (Kuniyuki Iwashima)
- mptcp: clear scheduled subflows on retransmit (Paolo Abeni)
- mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level (Jisheng Zhang)
- mm/memfd: fix information leak in hugetlb folios (Deepanshu Kartikey) [Orabug: 38773697] {CVE-2025-68292}
- firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli)
- nvmem: layouts: fix nvmem_layout_bus_uevent (Guan Wentao)
- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin)
- thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski)
- smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773703] {CVE-2025-68295}
- drivers/usb/dwc3: fix PCI parent check (Jamie Iles)
- dm-verity: fix unreliable memory allocation (Mikulas Patocka)
- ceph: fix crash in process_v2_sparse_read() for encrypted directories (Viacheslav Dubeyko) [Orabug: 38773716] {CVE-2025-68297}
- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde)
- can: sja1000: fix max irq loop handling (Thomas Mühlbacher)
- Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref (Douglas Anderson) [Orabug: 38773723] {CVE-2025-68298}
- atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han)
- ARM: dts: nxp: imx6ul: correct SAI3 interrupt line (Maarten Zanders)
- arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity (Xu Yang)
- arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos (Frank Li)
- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (Ivan Zhaldak)
- tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (Deepanshu Kartikey) [Orabug: 38792583] {CVE-2025-68329}
- MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow (Thomas Bogendoerfer)
- MIPS: mm: Prevent a TLB shutdown on initial uniquification (Maciej W. Rozycki)
- iio: adc: rtq6056: Correct the sign bit index (Chiyuan Huang)
- iio: adc: ad7280a: fix ad7280_store_balance_timer() (David Lechner)
- iio: accel: fix ADXL355 startup race condition (Valek Andrej)
- iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792585] {CVE-2025-68330}
- iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling (Olivier Moysan)
- iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet)
- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra)
- iio: humditiy: hdc3020: fix units for thresholds and hysteresis (Dimitri Fedrau)
- iio: humditiy: hdc3020: fix units for temperature and humidity measurement (Dimitri Fedrau)
- iio: buffer: support getting dma channel from the buffer (Nuno Sa)
- iio: buffer-dmaengine: enable .get_dma_dev() (Nuno Sa)
- iio: buffer-dma: support getting the DMA channel (Nuno Sa)
- Revert "perf/x86: Always store regs-&gt;ip in perf_callchain_kernel()" (Jiri Olsa)
- Revert "drm/amd/display: Move setup_stream_attribute" (Alex Deucher)
- spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou)
- spi: nxp-fspi: Propagate fwnode in ACPI case as well (Andy Shevchenko)
- spi: spi-nxp-fspi: Add OCT-DTR mode support (Haibo Chen)
- spi: spi-nxp-fspi: remove the goto in probe (Haibo Chen)
- spi: nxp-fspi: Support per spi-mem operation frequency switches (Miquel Raynal)
- spi: spi-mem: Add a new controller capability (Miquel Raynal)
- spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency (Miquel Raynal)
- spi: spi-mem: Allow specifying the byte order in Octal DTR mode (Tudor Ambarus)
- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (Xu Wang)
- spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA (Francesco Lavra)
- fs/namespace: fix reference leak in grab_requested_mnt_ns (Andrei Vagin) [Orabug: 38773950] {CVE-2025-68300}
- mailbox: pcc: don't zero error register (Jamie Iles)
- mailbox: pcc: Refactor error handling in irq handler into separate function (Sudeep Holla)
- mailbox: mtk-cmdq: Refine DMA address handling for the command buffer (Jason-JH Lin)
- mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang)
- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (Xu Wang)
- iio: st_lsm6dsx: Fixed calibrated timestamp calculation (Mario Tesi)
- net: fec: do not register PPS event for PEROUT (Wei Fang)
- net: fec: do not allow enabling PPS and PEROUT simultaneously (Wei Fang)
- net: fec: do not update PEROUT if it is enabled (Wei Fang)
- net: fec: cancel perout_timer when PEROUT is disabled (Wei Fang)
- net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773728] {CVE-2025-68301}
- eth: fbnic: Fix counter roll-over issue (Mohsin Bashir)
- net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean)
- net: dsa: sja1105: simplify static configuration reload (Russell King)
- net: wwan: mhi: Keep modem name match with Foxconn T99W640 (Slark Xiao)
- drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (Alex Deucher)
- net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev)
- team: Move team device type change at the end of team_port_add (Nikola Z. Ivanov) [Orabug: 38796270] {CVE-2025-68340}
- net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino)
- drm/xe: Fix conversion from clock ticks to milliseconds (Harish Chegondi)
- net: lan966x: Fix the initialization of taprio (Horatiu Vultur)
- net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng)
- platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter)
- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (Daniel Golle)
- veth: reduce XDP no_direct return section to fix race (Jesper Dangaard Brouer) [Orabug: 38796276] {CVE-2025-68341}
- veth: more robust handing of race to avoid txq getting stuck (Jesper Dangaard Brouer)
- veth: prevent NULL pointer dereference in veth_xdp_rcv (Jesper Dangaard Brouer)
- veth: apply qdisc backpressure on full ptr_ring to reduce TX drops (Jesper Dangaard Brouer)
- net: sched: generalize check for no-queue qdisc on TX queue (Jesper Dangaard Brouer)
- Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz)
- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (Edward Adam Davis) [Orabug: 38773949] {CVE-2025-68305}
- Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP (Luiz Augusto von Dentz)
- Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface (Chris Lu) [Orabug: 38773748] {CVE-2025-68306}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data (Marc Kleine-Budde) [Orabug: 38796278] {CVE-2025-68342}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header (Marc Kleine-Budde) [Orabug: 38796285] {CVE-2025-68343}
- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (Marc Kleine-Budde) [Orabug: 38773751] {CVE-2025-68307}
- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [Orabug: 38773759] {CVE-2025-68308}
- LTS version: v6.12.60 (Jack Vogel)
- Revert "gpio: swnode: don't use the swnode's name as the key for GPIO lookup" (Charles Keepax)
- drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched (Fangzhi Zuo)
- drm/amd/display: Insert dccg log for easy debug (Charlene Liu)
- drm/amd/display: disable DPP RCG before DPP CLK enable (Charlene Liu)
- drm/amd/display: avoid reset DTBCLK at clock init (Charlene Liu)
- xfs: fix out of bounds memory read error in symlink repair (Darrick J. Wong) [Orabug: 38730602] {CVE-2025-40246}
- xfs: Replace strncpy with memcpy (Marcelo Moreira)
- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730655] {CVE-2025-40257}
- drm/i915/dp_mst: Disable Panel Replay (Imre Deak)
- maple_tree: fix tracepoint string pointers (Martin Kaiser)
- tty/vt: fix up incorrect backport to stable releases (Jari Ruusu)
- smb: client: fix incomplete backport in cfids_invalidation_worker() (Henrique Carvalho)
- drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (Samuel Zhang) [Orabug: 38773445] {CVE-2025-68230}
- tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun)
- net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
- ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe)
- s390/mm: Fix __ptep_rdp() inline assembly (Heiko Carstens)
- drm/xe: Prevent BIT() overflow when handling invalid prefetch region (Shuicheng Lin)
- Revert "RDMA/irdma: Update Kconfig" (Guan Wentao)
- KVM: arm64: Make all 32bit ID registers fully writable (Marc Zyngier)
- ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai)
- kconfig/nconf: Initialize the default locale at startup (Jakub Horký)
- kconfig/mconf: Initialize the default locale at startup (Jakub Horký)
- net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit)
- blk-crypto: use BLK_STS_INVAL for alignment errors (Carlos Llamas)
- net: tls: Change async resync helpers argument (Shahar Shitrit)
- selftests: net: use BASH for bareudp testing (Po-Hsu Lin)
- x86/microcode/AMD: Limit Entrysign signature checking to known generations (Borislav Petkov)
- scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773425] {CVE-2025-68224}
- cifs: fix typo in enable_gcm_256 module parameter (Steve French)
- bcma: don't register devices disabled in OF (Rafał Miłecki)
- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730610] {CVE-2025-40248}
- cifs: fix memory leak in smb3_fs_context_parse_param error path (Shaurya Rane) [Orabug: 38773403] {CVE-2025-68219}
- LoongArch: Use UAPI types in ptrace UAPI header (Thomas Weißschuh)
- af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic(). (Kuniyuki Iwashima)
- af_unix: Cache state-&gt;msg in unix_stream_read_generic(). (Kuniyuki Iwashima)
- devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (Shay Drory) [Orabug: 38730623] {CVE-2025-40251}
- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (Jared Kangas)
- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (Jared Kangas)
- ice: fix PTP cleanup on driver removal in error path (Grzegorz Nitka) [Orabug: 38773389] {CVE-2025-68215}
- idpf: fix possible vport_config NULL pointer deref in remove (Emil Tantilov) [Orabug: 38773956] {CVE-2025-68213}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730628] {CVE-2025-40252}
- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang)
- selftests: net: lib: Do not overwrite error messages (Ido Schimmel)
- s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
- nvme-multipath: fix lockdep WARN due to partition scan work (Shin'Ichiro Kawasaki) [Orabug: 38773400] {CVE-2025-68218}
- tools: riscv: Fixed misalignment of CSR related definitions (Chen Pei)
- net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730647] {CVE-2025-40254}
- net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() (Pavel Zhigulin)
- net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin)
- drm/tegra: Add call to put_pid() (Prateek Agarwal) [Orabug: 38773463] {CVE-2025-68233}
- mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
- platform/x86: msi-wmi-platform: Fix typo in WMI GUID (Armin Wolf)
- platform/x86: msi-wmi-platform: Only load on MSI devices (Armin Wolf)
- pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() (Xu Wang)
- xfrm: Prevent locally generated packets from direct output in tunnel mode (Jianbo Liu)
- xfrm: Determine inner GSO type from packet inner protocol (Jianbo Liu)
- pinctrl: realtek: Select REGMAP_MMIO for RTD driver (Yu-Chun Lin)
- xfrm: set err and extack on failure to create pcpu SA (Sabrina Dubroca)
- xfrm: drop SA reference in xfrm_state_update if dir doesn't match (Sabrina Dubroca)
- drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 (Ivan Lipski)
- drm/amd/display: Fix pbn to kbps Conversion (Fangzhi Zuo)
- drm/amd/display: Move sleep into each retry for retrieve_link_cap() (Mario Limonciello)
- drm/amd/display: Increase DPCD read retries (Mario Limonciello)
- drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (Yifan Zha)
- drm/amd: Skip power ungate during suspend for VPE (Mario Limonciello)
- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (Robert Mcclinton) [Orabug: 38773418] {CVE-2025-68223}
- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke)
- mptcp: do not fallback when OoO is present (Paolo Abeni)
- mptcp: decouple mptcp fastclose from tcp close (Paolo Abeni)
- mptcp: avoid unneeded subflow-level drops (Paolo Abeni)
- selftests: mptcp: join: userspace: longer timeout (Matthieu Baerts)
- selftests: mptcp: join: endpoints: longer timeout (Matthieu Baerts)
- mptcp: fix premature close in case of fallback (Paolo Abeni)
- mptcp: fix duplicate reset on fastclose (Paolo Abeni)
- mptcp: fix ack generation for fallback msk (Paolo Abeni)
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730658] {CVE-2025-40258}
- LoongArch: Don't panic if no valid cache info for PCI (Huacai Chen)
- dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski)
- MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
- scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773439] {CVE-2025-68229}
- scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730661] {CVE-2025-40259}
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730672] {CVE-2025-40261}
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne)
- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (Nam Cao) [Orabug: 38773467] {CVE-2025-68235}
- mm/mempool: fix poisoning order&gt;0 pages with HIGHMEM (Vlastimil Babka) [Orabug: 38773453] {CVE-2025-68231}
- Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
- Input: imx_sc_key - fix memory corruption on unload (Dan Carpenter)
- Input: goodix - add support for ACPI ID GDIX1003 (Hans de Goede)
- Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730679] {CVE-2025-40263}
- Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" (Diogo Ivo)
- net: dsa: microchip: lan937x: Fix RGMII delay tuning (Oleksij Rempel)
- be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730688] {CVE-2025-40264}
- ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() (Yihang Li)
- smb: client: introduce close_cached_dir_locked() (Henrique Carvalho)
- ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
- mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773434] {CVE-2025-68227}
- mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen)
- exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang)
- shmem: fix tmpfs reconfiguration (remount) when noswap is set (Mike Yuan)
- isofs: check the return value of sb_min_blocksize() in isofs_fill_super (Yongpeng Yang)
- mtdchar: fix integer overflow in read/write ioctls (Dan Carpenter) [Orabug: 38773476] {CVE-2025-68237}
- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara)
- arm64: dts: rockchip: disable HS400 on RK3588 Tiger (Quentin Schulz)
- arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1 (Quentin Schulz)
- arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5 (Mykola Kvach)
- arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2 (Diederik de Haas)
- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
- HID: amd_sfh: Stop sensor before starting (Mario Limonciello)
- timers: Fix NULL function pointer race in timer_shutdown_sync() (Yipeng Zou) [Orabug: 38773387] {CVE-2025-68214}
- KVM: arm64: Check the untrusted offset in FF-A memory share (Sebastian Ene) [Orabug: 38730696] {CVE-2025-40266}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.2.el10uek]" date="1766491200">- LTS version: v6.12.63 (Jack Vogel)
- ASoC: codecs: nau8325: Silence uninitialized variables warnings (Krzysztof Kozlowski)
- ALSA: wavefront: Fix integer overflow in sample size validation (Junrui Luo)
- ALSA: dice: fix buffer overflow in detect_stream_formats() (Junrui Luo)
- usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required (Sven Peter)
- usb: phy: Initialize struct usb_phy list_head (Diogo Ivo)
- usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (Haotien Hsu)
- tcp_metrics: use dst_dev_net_rcu() (Eric Dumazet) [Orabug: 38592188] {CVE-2025-40075}
- net: dst: introduce dst-&gt;dev_rcu (Eric Dumazet)
- net: lan743x: Allocate rings outside ZONE_DMA (Thangaraj Samynathan)
- LoongArch: Add machine_kexec_mask_interrupts() implementation (Huacai Chen)
- ocfs2: fix memory leak in ocfs2_merge_rec_left() (Dmitry Antipov)
- irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (Dan Carpenter)
- scsi: imm: Fix use-after-free bug caused by unfinished delayed work (Duoming Zhou) [Orabug: 38783113] {CVE-2025-68324}
- efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs (Mauro Carvalho Chehab)
- efi/cper: Adjust infopfx size to accept an extra space (Mauro Carvalho Chehab)
- efi/cper: Add a new helper function to print bitmasks (Mauro Carvalho Chehab)
- dm log-writes: Add missing set_freezable() for freezable kthread (Xu Wang)
- dm-raid: fix possible NULL dereference with undefined raid type (Alexey Simakov)
- block: return unsigned int from queue_dma_alignment (Christoph Hellwig)
- block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set-&gt;tag_list_lock (Mohamed Khalfella) [Orabug: 38818209] {CVE-2025-68756}
- ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() (Pangliyuan)
- ALSA: firewire-motu: add bounds check in put_user loop for DSP events (Junrui Luo)
- rtc: gamecube: Check the return value of ioremap() (Xu Wang)
- drm/amdkfd: Use huge page size to check split svm range alignment (Xiaogang Chen)
- ALSA: uapi: Fix typo in asound.h comment (Andres J Rosa)
- docs: hwmon: fix link to g762 devicetree binding (Kathara Sasikumar)
- cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 (David Howells)
- drm/nouveau: refactor deprecated strcpy (Madhur Kumar)
- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (Junrui Luo)
- regulator: fixed: Rely on the core freeing the enable GPIO (Mark Brown)
- drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() (Dan Carpenter)
- nvme-auth: use kvfree() for memory allocated with kvcalloc() (Israel Rukshin)
- block: fix memory leak in __blkdev_issue_zero_pages (Shaurya Rane) [Orabug: 38798772] {CVE-2025-68348}
- block: fix comment for op_is_zone_mgmt() to include RESET_ALL (Shechenglong)
- blk-mq: Abort suspend when wakeup events are pending (Cong Zhang)
- ASoC: ak5558: Disable regulator when error happens (Shengjiu Wang)
- ASoC: ak4458: Disable regulator when error happens (Shengjiu Wang)
- ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (Xu Wang)
- platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (Anton Khirnov)
- fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() (Armin Wolf)
- NFS: Fix inheritance of the block sizes when automounting (Trond Myklebust)
- Expand the type of nfs_fattr-&gt;valid (Trond Myklebust)
- NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (Trond Myklebust) [Orabug: 38818236] {CVE-2025-68764}
- Revert "nfs: ignore SB_RDONLY when mounting nfs" (Trond Myklebust)
- Revert "nfs: clear SB_RDONLY before getting superblock" (Trond Myklebust)
- Revert "nfs: ignore SB_RDONLY when remounting nfs" (Trond Myklebust)
- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (Jonathan Curley) [Orabug: 38798774] {CVE-2025-68349}
- NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state (Trond Myklebust)
- nfs/vfs: discard d_exact_alias() (Neil Brown)
- NFS: Initialise verifiers for visible dentries in nfs_atomic_open() (Trond Myklebust)
- NFS: Initialise verifiers for visible dentries in readdir and lookup (Trond Myklebust)
- fs/nls: Fix utf16 to utf8 conversion (Armin Wolf)
- NFS: Avoid changing nlink when file removes and attribute updates race (Trond Myklebust)
- f2fs: maintain one time GC mode is enabled during whole zoned GC cycle (Daeho Jeong)
- f2fs: add gc_boost_gc_greedy sysfs node (Daeho Jeong)
- f2fs: add gc_boost_gc_multiple sysfs node (Daeho Jeong)
- f2fs: introduce reserved_pin_section sysfs entry (Chao Yu)
- f2fs: sysfs: add encoding_flags entry (Chao Yu)
- f2fs: add carve_out sysfs node (Daeho Jeong)
- f2fs: fix to avoid running out of free segments (Chao Yu)
- f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages (Jaegeuk Kim)
- f2fs: keep POSIX_FADV_NOREUSE ranges (Jaegeuk Kim)
- platform/x86:intel/pmc: Update Arrow Lake telemetry GUID (Xi Pardee)
- sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out (Xupengbo)
- 9p: fix cache/debug options printing in v9fs_show_options (Eric Sandeen)
- fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (Abdun Nihaal)
- pinctrl: single: Fix incorrect type for error return variable (Xu Wang)
- perf hist: In init, ensure mem_info is put on error paths (Ian Rogers)
- perf tools: Fix split kallsyms DSO counting (Namhyung Kim)
- perf tools: Mark split kallsyms DSOs as loaded (Namhyung Kim)
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei) [Orabug: 38783136] {CVE-2025-68325}
- net: dsa: xrs700x: reject unsupported HSR configurations (Vladimir Oltean)
- net: hsr: create an API to get hsr port type (Xiaoliang Yang)
- net: hsr: Create and export hsr_get_port_ndev() (Md Danish Anwar)
- net: hsr: remove synchronize_rcu() from hsr_add_port() (Eric Dumazet)
- net: hsr: remove one synchronize_rcu() from hsr_del_port() (Eric Dumazet)
- clk: keystone: fix compile testing (Johan Hovold)
- md/raid5: fix IO hang when array is broken with IO inflight (Yu Kuai)
- remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs (Alexandru Gagniuc)
- mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (Ivan Stepchenko)
- selftests: bonding: add delay before each xvlan_over_bond connectivity check (Hangbin Liu)
- selftests: bonding: add ipvlan over bond testing (Etienne Champetier)
- net: phy: aquantia: check for NVMEM deferral (Robert Marko)
- vfio/pci: Use RCU for error/request triggers to avoid circular locking (Alex Williamson)
- spi: ch341: fix out-of-bounds memory access in ch341_transfer_one (Tianchu Chen)
- mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (Xu Wang)
- net: stmmac: fix rx limit check in stmmac_rx_zc() (Alexey Kodanev)
- netfilter: nft_connlimit: update the count if add was skipped (Fernando Fernandez Mancera)
- netfilter: nf_conncount: rework API to use sk_buff directly (Fernando Fernandez Mancera)
- netfilter: flowtable: check for maximum number of encapsulations in bridge vlan (Pablo Neira Ayuso)
- Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" (Ilias Stamatis)
- resource: introduce is_type_match() helper and use it (Andy Shevchenko)
- resource: replace open coded resource_intersection() (Andy Shevchenko)
- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (Sparkhuang) [Orabug: 38798786] {CVE-2025-68354}
- ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND (Mikhail Kshevetskiy)
- ASoC: Intel: catpt: Fix error path in hw_params() (Cezary Rojewski)
- vdpa/pds: use %pe for ERR_PTR() in event handler registration (Alok Tiwari)
- vhost: Fix kthread worker cgroup failure handling (Mike Christie)
- vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues (Alok Tiwari)
- virtio: fix virtqueue_set_affinity() docs (Michael S. Tsirkin)
- virtio: fix grammar in virtio_queue_info docs (Michael S. Tsirkin)
- virtio: fix whitespace in virtio_config_ops (Michael S. Tsirkin)
- virtio: fix typo in virtio_device_ready() comment (Michael S. Tsirkin)
- virtio_vdpa: fix misleading return in void function (Alok Tiwari)
- of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node (Guenter Roeck)
- ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation (Yongjian Sun)
- ublk: prevent invalid access with DEBUG (Kevin Brodsky)
- ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (René Rebe)
- hwmon: sy7636a: Fix regulator_enable resource leak on error path (Xu Wang)
- drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (Dan Carpenter)
- greybus: gb-beagleplay: Fix timeout handling in bootloader functions (Xu Wang)
- firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER (Alexandre Courbot)
- ASoC: fsl_xcvr: clear the channel status control memory (Shengjiu Wang)
- gfs2: Prevent recursive memory reclaim (Andreas Gruenbacher) [Orabug: 38798793] {CVE-2025-68356}
- ASoC: nau8325: add missing build config (Jaroslav Kysela)
- ASoC: nau8325: use simple i2c probe function (Jaroslav Kysela)
- drm/panthor: Avoid adding of kernel BOs to extobj list (Akash Goel)
- RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY (Jacob Moroni)
- RDMA/irdma: Fix data race in irdma_free_pble (Krzysztof Czurylo)
- RDMA/irdma: Fix data race in irdma_sc_ccq_arm (Krzysztof Czurylo)
- iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal (Stephan Gerhold)
- backlight: lp855x: Fix lp855x.h kernel-doc warnings (Randy Dunlap)
- backlight: led-bl: Add devlink to supplier LEDs (Luca Ceresoli)
- wifi: ieee80211: correct FILS status codes (Ria Thomas)
- iomap: always run error completions in user context (Christoph Hellwig)
- iomap: factor out a iomap_dio_done helper (Christoph Hellwig)
- um: Don't rename vmap to kernel_vmap (David Gow)
- drm/nouveau: restrict the flush page to a 32-bit address (Timur Tabi)
- PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (Shawn Lin)
- btrfs: fix leaf leak in an error path in btrfs_del_items() (Filipe Manana)
- iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables (Ryan Huang)
- staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (Jianglei Nie)
- firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (Dinh Nguyen)
- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (Zilin Guan)
- ASoC: tas2781: correct the wrong period (Shenghao Ding)
- RDMA/bnxt_re: Pass correct flag for dma mr creation (Selvin Xavier)
- RDMA/bnxt_re: Fix the inline size for GenP7 devices (Selvin Xavier)
- erofs: limit the level of fs stacking for file-backed mounts (Gao Xiang)
- RISC-V: KVM: Fix guest page fault within HLV* instructions (Fangyu Yu)
- crypto: ccree - Correctly handle return of sg_nents_for_len (Xu Wang)
- crypto: starfive - Correctly handle return of sg_nents_for_len (Xu Wang)
- selftests/bpf: Improve reliability of test_perf_branches_no_hw() (Matt Bobrowski)
- selftests/bpf: skip test_perf_branches_hw() on unsupported platforms (Matt Bobrowski)
- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon)
- usb: dwc2: fix hang during suspend if set as peripheral (Jisheng Zhang)
- usb: dwc2: fix hang during shutdown if set as peripheral (Jisheng Zhang)
- usb: dwc2: disable platform lowlevel hw resources during shutdown (Jisheng Zhang)
- usb: chaoskey: fix locking for O_NONBLOCK (Oliver Neukum)
- ima: Handle error code returned by ima_filter_rule_match() (Zhao Yipeng) [Orabug: 38798921] {CVE-2025-68740}
- RAS: Report all ARM processor CPER information to userspace (Jason Tian)
- wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (Seungjin Bae) [Orabug: 38798814] {CVE-2025-68362}
- cpuset: Treat cpusets in attaching as populated (Chen Ridong)
- net: phy: adin1100: Fix software power-down ready condition (Alexander Dahl)
- phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth (Cristian Ciocaltea)
- phy: freescale: Initialize priv-&gt;lock (Xiaolei Wang)
- phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (Christophe Jaillet)
- leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM (Fenglin Wu)
- mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- wifi: mac80211: fix CMAC functions not handling errors (Chien Wong)
- iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb (Aashish Sharma)
- scsi: qla2xxx: Fix improper freeing of purex item (Zilin Guan) [Orabug: 38798928] {CVE-2025-68741}
- pwm: bcm2835: Make sure the channel is enabled after pwm_request() (Uwe Kleine-König)
- perf arm_spe: Fix memset subclass in operation (Leo Yan)
- perf arm-spe: Extend branch operations (Leo Yan)
- ipv6: clear RA flags when adding a static route (Fernando Fernandez Mancera)
- drm/msm/a6xx: Improve MX rail fallback in RPMH vote init (Akhil P Oommen)
- drm/msm/a6xx: Fix the gemnoc workaround (Akhil P Oommen)
- drm/msm/a6xx: Flush LRZ cache before PT switch (Akhil P Oommen)
- drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (Jay Liu)
- fs/ntfs3: Prevent memory leaks in add sub record (Edward Adam Davis)
- fs/ntfs3: out1 also needs to put mi (Edward Adam Davis)
- powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format (Ritesh Harjani)
- powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit (Ritesh Harjani)
- bpf: Fix invalid prog-&gt;stats access when update_effective_progs fails (Pu Lehui) [Orabug: 38798931] {CVE-2025-68742}
- wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (Abdun Nihaal) [Orabug: 38818221] {CVE-2025-68759}
- drm/msm/a2xx: stop over-complaining about the legacy firmware (Dmitry Baryshkov)
- block/blk-throttle: Fix throttle slice time for SSDs (Guenter Roeck)
- NFSD/blocklayout: Fix minlength check in proc_layoutget (Sergey Bashirov)
- tracefs: fix a leak in eventfs_create_events_dir() (Al Viro)
- watchdog: starfive: Fix resource leak in probe error path (Xu Wang)
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (Xu Wang)
- bpf: Check skb-&gt;transport_header is set in bpf_skb_check_mtu (Martin Kafai Lau) [Orabug: 38798820] {CVE-2025-68363}
- selftests/bpf: Fix failure paths in send_signal test (Alexei Starovoitov)
- bpf: Handle return value of ftrace_set_filter_ip in register_fentry (Menglong Dong)
- ps3disk: use memcpy_{from,to}_bvec index (René Rebe)
- drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype (Dmitry Baryshkov)
- crypto: iaa - Fix incorrect return value in save_iaa_wq() (Zilin Guan)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C (Fukaumi Naoki)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A (Fukaumi Naoki)
- arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A (Fukaumi Naoki)
- PCI: keystone: Exit ks_pcie_probe() for invalid mode (Siddharth Vadapalli)
- bpf: Free special fields when update [lru_,]percpu_hash maps (Leon Hwang) [Orabug: 38798936] {CVE-2025-68744}
- leds: netxbig: Fix GPIO descriptor leak in error paths (Xu Wang)
- scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls (Xu Wang)
- ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (Xu Wang)
- ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() (Dmitry Antipov) [Orabug: 38798823] {CVE-2025-68364}
- lib/vsprintf: Check pointer before dereferencing in time_and_date() (Andy Shevchenko)
- clk: renesas: r9a06g032: Fix memory leak in error path (Xu Wang)
- coresight: etm4x: Add context synchronization before enabling trace (Leo Yan)
- coresight: etm4x: Extract the trace unit controlling (Leo Yan)
- coresight: etm4x: Correct polling IDLE bit (Leo Yan)
- coresight: Change device mode to atomic type (Leo Yan)
- nbd: defer config unlock in nbd_genl_connect (Zheng Qixing) [Orabug: 38798832] {CVE-2025-68366}
- wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (Abdun Nihaal)
- macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (Long Li) [Orabug: 38798837] {CVE-2025-68367}
- powerpc/32: Fix unpaired stwcx. on interrupt exit (Christophe Leroy)
- powerpc/kdump: Fix size calculation for hot-removed memory ranges (Sourabh Jain)
- cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs (Gautham R. Shenoy)
- scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() (Bean Huo)
- drm/panthor: Fix potential memleak of vma structure (Akash Goel)
- ntfs3: init run lock for extend inode (Edward Adam Davis)
- ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties (Jihed Chaibi)
- RDMA/rtrs: server: Fix error handling in get_or_create_srv (Ma Ke)
- dt-bindings: PCI: amlogic: Fix the register name of the DBI region (Manivannan Sadhasivam)
- scsi: smartpqi: Fix device resources accessed after device removal (Mike Mcgowen) [Orabug: 38798847] {CVE-2025-68371}
- scsi: stex: Fix reboot_notifier leak in probe error path (Xu Wang)
- nbd: defer config put in recv_work (Zheng Qixing) [Orabug: 38798850] {CVE-2025-68372}
- md: fix rcu protection in md_wakeup_thread (Yun Zhou) [Orabug: 38798857] {CVE-2025-68374}
- regulator: core: disable supply if enabling main regulator fails (Gabor Juhos)
- perf/x86/intel: Correct large PEBS flag check (Dapeng Mi)
- ext4: correct the checking of quota files before moving extents (Zhang Yi)
- mfd: da9055: Fix missing regmap_del_irq_chip() in error path (Xu Wang)
- locktorture: Fix memory leak in param_set_cpumask() (Wang Liang)
- efi/libstub: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- x86/boot: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels (Yegor Yefremov)
- libbpf: Fix parsing of multi-split BTF (Alan Maguire)
- spi: tegra210-quad: Fix timeout handling (Vishwaroop A) [Orabug: 38798943] {CVE-2025-68746}
- drm/panthor: Fix UAF on kernel BO VA nodes (Boris Brezillon)
- drm/panthor: Fix race with suspend during unplug (Ketil Johnsen)
- drm/panthor: Fix UAF race between device unplug and FW event processing (Ketil Johnsen)
- drm/panthor: Fix group_free_queue() for partially initialized queues (Boris Brezillon)
- drm/panthor: Handle errors returned by drm_sched_entity_init() (Boris Brezillon)
- fs/9p: Don't open remote file with APPEND mode when writeback cache is used (Tingmao Wang)
- scsi: target: Do not write NUL characters into ASCII configfs output (Bart Van Assche)
- power: supply: apm_power: only unset own apm_get_power_status (Ahelenia Ziemiańska)
- power: supply: wm831x: Check wm831x_set_bits() return value (Ivan Abramov)
- power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (Murad Masimov)
- power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (Ivan Abramov)
- power: supply: max17040: Check iio_read_channel_processed() return code (Ivan Abramov)
- power: supply: cw2015: Check devm_delayed_work_autocancel() return code (Ivan Abramov)
- power: supply: rt5033_charger: Fix device node reference leaks (Xu Wang)
- perf record: skip synthesize event when open evsel failed (Shuai Xue)
- perf lock contention: Load kernel map before lookup (Namhyung Kim)
- drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() (Geert Uytterhoeven)
- interconnect: debugfs: Fix incorrect error handling for NULL path (Kuan-Wei Chiu)
- arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller (Dmitry Baryshkov)
- interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS (Dmitry Baryshkov)
- wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() (Abdun Nihaal)
- i3c: master: svc: Prevent incomplete IBI transaction (Stanley Chu)
- i3c: fix refcount inconsistency in i3c_master_register (Frank Li)
- pinctrl: stm32: fix hwspinlock resource leak in probe function (Xu Wang)
- soc: qcom: smem: fix hwspinlock resource leak in probe error paths (Xu Wang)
- tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set (Benjamin Berg)
- x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() (Tengda Wu)
- task_work: Fix NMI race condition (Peter Zijlstra)
- perf/x86/intel/cstate: Remove PC3 support from LunarLake (Zhang Rui)
- bpf: Fix stackmap overflow check in __bpf_get_stackid() (Arnaud Lecomte) [Orabug: 38798864] {CVE-2025-68378}
- bpf: Refactor stack map trace depth calculation into helper function (Arnaud Lecomte)
- perf: Remove get_perf_callchain() init_nr argument (Josh Poimboeuf)
- mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (Xu Wang)
- mtd: nand: relax ECC parameter validation check (Aryan Srivastava)
- Revert "mtd: rawnand: marvell: fix layouts" (Aryan Srivastava)
- ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties (Wolfram Sang)
- ARM: dts: renesas: gose: Remove superfluous port property (Wolfram Sang)
- RDMA/rxe: Fix null deref on srq-&gt;rq.queue after resize failure (Zhu Yanjun) [Orabug: 38798867] {CVE-2025-68379}
- sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Kuniyuki Iwashima)
- phy: mscc: Fix PTP for VSC8574 and VSC8572 (Horatiu Vultur)
- arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory (Alexander Martinz)
- arm64: dts: qcom: sm8650: set ufs as dma coherent (Neil Armstrong)
- arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider (Gergo Koteles)
- arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller (Krishna Kurapati)
- arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller (Krishna Kurapati)
- firmware: imx: scu-irq: fix OF node leak in (Peng Fan)
- arm64: dts: ti: k3-am62p: Fix memory ranges for GPU (Randolph Sapp)
- s390/ap: Don't leak debug feature files if AP instructions are not available (Heiko Carstens)
- s390/smp: Fix fallback CPU detection (Heiko Carstens)
- wifi: ath11k: fix peer HE MCS assignment (Baochen Qiang) [Orabug: 38798872] {CVE-2025-68380}
- wifi: ath11k: fix VHT MCS assignment (Baochen Qiang)
- crypto: hisilicon/qm - restore original qos values (Nieweiqiang)
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (Thorsten Blum) [Orabug: 38798874] {CVE-2025-68724}
- soc: qcom: gsbi: fix double disable caused by devm (Xu Wang)
- soc: Switch back to struct platform_driver::remove() (Uwe Kleine-König)
- clk: qcom: camcc-sm7150: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (Li Qiang)
- PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (Geert Uytterhoeven)
- arm64: dts: exynos: gs101: fix sysreg_apm reg property (Peter Griffin)
- perf annotate: Check return value of evsel__get_arch() properly (Tianyou Li)
- arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 (Tim Harvey)
- arm64: dts: imx8mp-venice-gw702x: remove off-board uart (Tim Harvey)
- arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl (Tim Harvey)
- arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props (Tim Harvey)
- block/mq-deadline: Switch back to a single dispatch list (Bart Van Assche)
- block/mq-deadline: Introduce dd_start_request() (Bart Van Assche)
- firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc (Randy Dunlap)
- iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (Francesco Lavra)
- inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() (Luoxuanqiang)
- inet: Avoid ehash lookup race in inet_ehash_insert() (Luoxuanqiang)
- rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() (Luoxuanqiang)
- clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets (Stephan Gerhold)
- ntfs3: Fix uninit buffer allocated by __getname() (Sidharth Seela)
- ntfs3: fix uninit memory after failed mi_read in mi_format_new (Raphael Pinsonneault-Thibeault)
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Herbert Xu)
- irqchip/qcom-irq-combiner: Fix section mismatch (Johan Hovold)
- irqchip/starfive-jh8100: Fix section mismatch (Johan Hovold)
- irqchip/renesas-rzg2l: Fix section mismatch (Johan Hovold)
- irqchip/imx-mu-msi: Fix section mismatch (Johan Hovold)
- irqchip/irq-brcmstb-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7120-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7038-l1: Fix section mismatch (Johan Hovold)
- sched/fair: Forfeit vruntime on yield (Fernand Sieber)
- wifi: ath11k: restore register window after global reset (Baochen Qiang)
- wifi: ath10k: move recovery check logic into a new work (Kang Yang)
- wifi: ath10k: Add missing include of export.h (Jeff Johnson)
- wifi: ath10k: Avoid vdev delete timeout when firmware is already down (Loic Poulain)
- objtool: Fix weak symbol detection (Josh Poimboeuf)
- objtool: Fix standalone --hacks=jump_label (Dylan Hatch)
- HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (Mavroudis Chatzilazaridis)
- drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() (Cyrille Pitchen)
- clk: renesas: cpg-mssr: Read back reset registers to assure values latched (Marek Vasut)
- clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register (Thierry Bultel)
- clk: renesas: Use str_on_off() helper (Geert Uytterhoeven)
- clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (Marek Vasut)
- pinctrl: renesas: rzg2l: Fix PMC restore (Biju Das)
- USB: Fix descriptor count when handling invalid MBIM extended descriptor (Seungjin Bae)
- drm/vgem-fence: Fix potential deadlock on release (Janusz Krzysztofik) [Orabug: 38818211] {CVE-2025-68757}
- accel/ivpu: Fix DCT active percent format (Karol Wachowski)
- accel/ivpu: Make function parameter names consistent (Jacek Lawrynowicz)
- drm/panel: visionox-rm69299: Don't clear all mode flags (Guido Günther)
- accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail (Karol Wachowski)
- accel/ivpu: Prevent runtime suspend during context abort work (Andrzej Kacprowski)
- gpu: host1x: Fix race in syncpt alloc/free (Mainak Sen) [Orabug: 38798898] {CVE-2025-68732}
- smack: fix bug: setting task label silently ignores input garbage (Konstantin Andreev)
- smack: fix bug: unprivileged task can create labels (Konstantin Andreev)
- smack: fix bug: invalid label of unix socket file (Konstantin Andreev)
- smack: always "instantiate" inode in smack_inode_init_security() (Konstantin Andreev)
- smack: deduplicate xattr setting in smack_inode_init_security() (Konstantin Andreev)
- smack: fix bug: SMACK64TRANSMUTE set on non-directory (Konstantin Andreev)
- smack: deduplicate "does access rule request transmutation" (Konstantin Andreev)
- net/mlx5e: Set default burst period for TX and RX reporters (Shahar Shitrit) [Orabug: 38636804]
- devlink: Make health reporter burst period configurable (Shahar Shitrit) [Orabug: 38636804]
- devlink: Introduce burst period for health reporter (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move health reporter recovery abort logic to a separate function (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move graceful period parameter to reporter ops (Shahar Shitrit) [Orabug: 38636804]
- devlink: use devlink_nl_put_u64() helper (Przemek Kitszel) [Orabug: 38636804]
- devlink: introduce devlink_nl_put_u64() (Przemek Kitszel) [Orabug: 38636804]
- Revert "net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery" (Qing Huang) [Orabug: 38636804]
- net/rds: improve conn destroy printk message (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: expand kref coverage to rds_notifier-&gt;n_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: rds_sendmsg must use rs_conn only when not being destroyed (Sharath Srinivasan) [Orabug: 38728742]
- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang) [Orabug: 38766139]
- mm: list_lru: avoid using NULL list_lru_one. (Imran Khan) [Orabug: 38787957]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg)
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa)
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn)
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe)
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping)
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen)
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan)
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo) [Orabug: 38847806] {CVE-2025-68789}
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera)
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38649136]  {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.1.el10uek]" date="1769688000">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang)  [Orabug: 38899652]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.2.el10uek]" date="1770897600">- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan)  [Orabug: 38937451]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.3.el10uek]" date="1771329600">- net/rds: Fix issue with a revert in rds_send_queue_rm (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
</package>
<package pkgid="975ed3672a18be81a5318fe6b6f3b025b190c558" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="109.67.6.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg) [Orabug: 38887626] {CVE-2025-71156}
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa) [Orabug: 38887628] {CVE-2025-71157}
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn) [Orabug: 38887618] {CVE-2025-71154}
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe) [Orabug: 38887603] {CVE-2025-71149}
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping) [Orabug: 38887600] {CVE-2025-71148}
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen) [Orabug: 38887596] {CVE-2025-71147}
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan) [Orabug: 38887608] {CVE-2025-71151}
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo)
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera) [Orabug: 38887785] {CVE-2025-71146}
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.6.el10uek]" date="1772884800">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong)  [Orabug: 39027305]</changelog>
</package>
<package pkgid="1e7e776687b263bf62551a26f3affa187394bdf7" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315]</changelog>
</package>
<package pkgid="084b6c646dfcef439ef76ea52af96f3626f2e988" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-200.74.27.2.el10uek]" date="1775649600">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39186444]  {CVE-2025-40135} 
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39181102]  {CVE-2026-23231} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39181101]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="89656c88813f33067f0a6a8d1f1724a7ff810eb8" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]  
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]  
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
</package>
<package pkgid="4e648342642df22f56a11cbd3d84a19005121fe3" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]  
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]  
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="a9e1043015baed94b0139201134f10eae2048129" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]  
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]  
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431} 
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]  
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]  
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]  
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
</package>
<package pkgid="a7fb1c0676275cbdc73c75a636a3d18ea757cc71" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-201.74.2.3.el10uek]" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39342689]  {CVE-2026-43500} 
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39342689]  
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39342689]  
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39342689]  
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39342689]  {CVE-2026-43284}</changelog>
</package>
<package pkgid="96dbcfe8f876fccb506a6fb93f010c338bfb4adc" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck)
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park)
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong)
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck)
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu)
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong)
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N)
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He)
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin)
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian)
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko)
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu)
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N)
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo)
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement)
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K)
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen)
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy)
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle)
- kexec: derive purgatory entry from symbol (Li Chen)
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao)
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez)
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey)
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang)
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev)
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong)
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong)
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson)
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo)
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig)
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav)
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed)
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang)
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao)
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal)
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal)
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li)
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li)
- media: radio-keene: fix memory leak in error path (Shaurya Rane)
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack)
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack)
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack)
- HID: hid-pl: handle probe errors (Oliver Neukum)
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson)
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers)
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han)
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian)
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski)
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu)
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni)
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo)
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi)
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo)
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa)
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen)
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai)
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt)
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov)
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal)
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li)
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni)
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek)
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui)
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith)
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith)
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai)
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan)
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan)
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus)
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook)
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek)
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin)
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu)
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao)
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi)
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen)
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang)
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li)
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab)
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab)
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab)
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab)
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang)
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho)
- gfs2: fiemap page fault fix (Andreas Gruenbacher)
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang)
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn)
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150]
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116]
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972]
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500} 
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]  
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513]  
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]  
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]  
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]  
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284} 
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
</package>
<package pkgid="645d3e776a26b8b555de1ab2323e390287c76d54" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974] {CVE-2026-43129}
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270} 
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278} 
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
</package>
<package pkgid="725372a5267e60a3a4913ef699379decf65c4afc" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278}
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-202.76.4.3.el10uek]" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391434]  {CVE-2026-46333}</changelog>
</package>
<package pkgid="b71268d7de1e27af1b0ed5d5d13f2f61caacd29f" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278}
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-202.76.4.3.el10uek]" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391434]  {CVE-2026-46333}</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.4.el10uek]" date="1779364800">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39420559]  {CVE-2026-46300} 
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39420559]</changelog>
</package>
<package pkgid="3df170e16fecd1d6c82f25d5b8e3a431158d338a" name="kernel-uek-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="203.76.7.1.el10uek"/>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) [Orabug: 39227772] {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) [Orabug: 39251164] {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) [Orabug: 39251169] {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) [Orabug: 39262447] {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) [Orabug: 39331678] {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) [Orabug: 39331784] {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) [Orabug: 39300554] {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) [Orabug: 39331889] {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) [Orabug: 39331303] {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) [Orabug: 39331577] {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) [Orabug: 39339241] {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) [Orabug: 39343623] {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) [Orabug: 39331924] {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) [Orabug: 39331696] {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) [Orabug: 39331680] {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) [Orabug: 39331661] {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) [Orabug: 39331512] {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) [Orabug: 39331937] {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) [Orabug: 39331435] {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) [Orabug: 39331422] {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) [Orabug: 39343538] {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) [Orabug: 39331504] {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) [Orabug: 39331827] {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) [Orabug: 39343546] {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) [Orabug: 39331482] {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) [Orabug: 39331693] {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) [Orabug: 39331458] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) [Orabug: 39331580] {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) [Orabug: 39331409] {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) [Orabug: 39331341] {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) [Orabug: 39331444] {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) [Orabug: 39331510] {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) [Orabug: 39331358] {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) [Orabug: 39331954] {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) [Orabug: 39331545] {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) [Orabug: 39331821] {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) [Orabug: 39331705] {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) [Orabug: 39331366] {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) [Orabug: 39331866] {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) [Orabug: 39331752] {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) [Orabug: 39331370] {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) [Orabug: 39331846] {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) [Orabug: 39331389] {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) [Orabug: 39331440] {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) [Orabug: 39343613] {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) [Orabug: 39331353] {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) [Orabug: 39331023] {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) [Orabug: 39331012] {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) [Orabug: 39331761] {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) [Orabug: 39331606] {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) [Orabug: 39331628] {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) [Orabug: 39331331] {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) [Orabug: 39331449] {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) [Orabug: 39331361] {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) [Orabug: 39331875] {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) [Orabug: 39331549] {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) [Orabug: 39331496] {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) [Orabug: 39331383] {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) [Orabug: 39331959] {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) [Orabug: 39343626] {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [Orabug: 39343577] {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) [Orabug: 39331591] {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) [Orabug: 39343531] {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) [Orabug: 39331853] {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) [Orabug: 39331859] {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) [Orabug: 39343609] {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) [Orabug: 39331003] {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) [Orabug: 39343515] {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) [Orabug: 39331318] {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) [Orabug: 39331375] {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) [Orabug: 39343527] {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) [Orabug: 39331585] {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) [Orabug: 39343616] {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) [Orabug: 39331719] {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) [Orabug: 39331807] {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) [Orabug: 39343628] {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) [Orabug: 39331070] {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) [Orabug: 39331308] {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) [Orabug: 39343581] {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) [Orabug: 39331918] {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) [Orabug: 39343603] {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) [Orabug: 39331896] {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) [Orabug: 39331636] {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) [Orabug: 39331947] {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) [Orabug: 39331518] {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) [Orabug: 39331877] {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) [Orabug: 39331789] {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) [Orabug: 39331882] {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) [Orabug: 39331312] {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) [Orabug: 39331077] {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 38649060,39186444,39202432] {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet) [Orabug: 38887740,39181101,39202431] {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera) [Orabug: 39029337,39131054] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe) [Orabug: 39144150,39343763] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao) [Orabug: 38970584,39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A) [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu) [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu) [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu) [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu) [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu) [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski) [Orabug: 39166116]</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.1.el10uek]" date="1776772800">- Revert "EDAC: Octeon: Init SDEI" (Jeremy Tang) [Orabug: 39203407]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.2.el10uek]" date="1777464000">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman) [Orabug: 39276980]
- uek-rpm/config-aarch64: Enable NVIDIA-recommended Vera-Rubin configs (Vijay Kumar) [Orabug: 39157707]
- kselftest/arm64: Add HWCAP test for FEAT_LS64 (Yicong Yang) [Orabug: 39157707]
- arm64: Provide basic EL2 setup for FEAT_{LS64, LS64_V} usage at EL0/1 (Yicong Yang) [Orabug: 39157707]
- perf: arm_spe: Relax period restriction (Leo Yan) [Orabug: 39157707]
- perf/arm_cspmu: Add PMEVFILT2R support (Robin Murphy) [Orabug: 39157707]
- ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional (Lifeng Zheng) [Orabug: 39157707]
- dt-bindings: gpio: Add Tegra256 support (Prathamesh Shete) [Orabug: 39157707]
- perf/arm_cspmu: nvidia: Add revision id matching (Besar Wicaksono) [Orabug: 39157707]
- arm64: Handle BRBE booting requirements (Anshuman Khandual) [Orabug: 39157707]
- arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again (Rob Herring) [Orabug: 39157707]
- arm64/gcs: Provide basic EL2 setup to allow GCS usage at EL0 and EL1 (Mark Brown) [Orabug: 39157707]
- tools headers arm64: Add NVIDIA Olympus part (Besar Wicaksono) [Orabug: 39157707]
- perf arm-spe: Add NVIDIA Olympus to neoverse list (Besar Wicaksono) [Orabug: 39157707]
- perf arm_spe: Add CPU variants supporting common data source packet (Leo Yan) [Orabug: 39157707]
- arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Yicong Yang) [Orabug: 39157707]
- perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Yicong Yang) [Orabug: 39157707]
- perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions (Yicong Yang) [Orabug: 39157707]
- perf/arm_cspmu: nvidia: Add pmevfiltr2 support (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Add pmpidr support (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Move register definitons to header (Robin Murphy) [Orabug: 39157707]
- perf/arm_cspmu: Add callback to reset filter config (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Generalise event filtering (Robin Murphy) [Orabug: 39157707]
- perf: arm_pmuv3: Add support for the Branch Record Buffer Extension (BRBE) (Rob Herring) [Orabug: 39157707]
- arm64/sysreg: Add BRBE registers and fields (Anshuman Khandual) [Orabug: 39157707]
- perf: arm_pmu: Move PMUv3-specific data (Mark Rutland) [Orabug: 39157707]
- perf: apple_m1: Don't disable counter in m1_pmu_enable_event() (Rob Herring) [Orabug: 39157707]
- perf: arm_v7_pmu: Don't disable counter in (armv7|krait_|scorpion_)pmu_enable_event() (Rob Herring) [Orabug: 39157707]
- perf: arm_v7_pmu: Drop obvious comments for enabling/disabling counters and interrupts (Rob Herring) [Orabug: 39157707]
- perf: arm_pmuv3: Don't disable counter in armv8pmu_enable_event() (Mark Rutland) [Orabug: 39157707]
- ACPI: CPPC: Rename EPP constants for clarity (Sumit Gupta) [Orabug: 39157707]
- ACPI: CPPC: Add three functions related to autonomous selection (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel() (Lifeng Zheng) [Orabug: 39157707]
- cpufreq/amd-pstate: Store the boost numerator as highest perf again (Mario Limonciello) [Orabug: 39157707]
- ACPI: CPPC: Refactor register value get and set ABIs (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Add cppc_set_reg_val() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Extract cppc_get_reg_val_in_pcc() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Optimize cppc_get_perf() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu() (Jie Zhan) [Orabug: 39157707]
- ACPI: CPPC: Clean up cppc_perf_caps and cppc_perf_ctrls structs (Sumit Gupta) [Orabug: 39157707]
- cpufreq: CPPC: Add generic helpers for sysfs show/store (Sumit Gupta) [Orabug: 39157707]
- cpufreq: CPPC: Add support for autonomous selection (Lifeng Zheng) [Orabug: 39157707]
- PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (Nirmoy Das) [Orabug: 39157707]
- PCI: Add ASPEED vendor ID to pci_ids.h (Nirmoy Das) [Orabug: 39157707]
- i2c: tegra: Add support for SW mutex register (Kartik) [Orabug: 39157707]
- i2c: tegra: Use internal reset when reset property is not available (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add HS mode support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Update Tegra256 timing parameters (Akhil R) [Orabug: 39157707]
- i2c: tegra: Use separate variables for fast and fastplus (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add Tegra264 support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add Tegra256 support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Do not configure DMA if not supported (Kartik) [Orabug: 39157707]
- gpio: tegra186: Fix GPIO name collisions for Tegra410 (Kartik) [Orabug: 39157707]
- gpio: tegra186: Use generic macro for port definitions (Kartik) [Orabug: 39157707]
- gpio: tegra186: Add support for Tegra410 (Prathamesh Shete) [Orabug: 39157707]
- gpio: tegra186: Add support for Tegra256 (Prathamesh Shete) [Orabug: 39157707]
- arm64: acpi: Enable ACPI CCEL support (Suzuki K Poulose) [Orabug: 39157707]
- arm64: Enable EFI secret area Securityfs support (Suzuki K Poulose) [Orabug: 39157707]
- arm64: realm: ioremap: Allow mapping memory as encrypted (Suzuki K Poulose) [Orabug: 39157707]
- arm64: Document Arm Confidential Compute (Steven Price) [Orabug: 39157707]
- virt: arm-cca-guest: TSM_REPORT support for realms (Sami Mujawar) [Orabug: 39157707]
- arm64: Enable memory encrypt for Realms (Suzuki K Poulose) [Orabug: 39157707]
- arm64: mm: Avoid TLBI when marking pages as valid (Steven Price) [Orabug: 39157707]
- arm64: Enforce bounce buffers for realm DMA (Steven Price) [Orabug: 39157707]
- efi: arm64: Map Device with Prot Shared (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Map unprotected MMIO as decrypted (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Add support for checking whether an MMIO is protected (Suzuki K Poulose) [Orabug: 39157707]
- arm64: realm: Query IPA size from the RMM (Steven Price) [Orabug: 39157707]
- arm64: Detect if in a realm and set RIPAS RAM (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Add RSI definitions (Suzuki K Poulose) [Orabug: 39157707]
- PCI/TPH: Add TPH documentation (Wei Huang) [Orabug: 39157707]
- PCI/TPH: Add Steering Tag support (Wei Huang) [Orabug: 39157707]
- PCI: Add TLP Processing Hints (TPH) support (Wei Huang) [Orabug: 39157707]
- sched: Update rq-&gt;avg_idle when a task is moved to an idle CPU (Shubhang Kaushik) [Orabug: 39214522]
- arm64: mte: Set TCMA1 whenever MTE is present in the kernel (Carl Worth) [Orabug: 39214522]
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov) [Orabug: 39241227,39273721] {CVE-2026-31628}
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp) [Orabug: 39252919]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp) [Orabug: 39259550]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.3.el10uek]" date="1777982400">- sched/deadline: Use revised wakeup rule for dl_server (Peter Zijlstra)
- netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [Orabug: 39339273] {CVE-2026-43084}
- netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -&gt; GFP_KERNEL_ACCOUNT allocation (Scott Mitchell)
- Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt" (Sasha Levin)
- Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads" (Sasha Levin)
- iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() (Zhen Ni) [Orabug: 39145066]
- iommu/amd: Fix header file (Vasant Hegde) [Orabug: 39145066]
- iommu/amd: Preserve default DTE fields when updating Host Page Table Root (Alejandro Jimenez) [Orabug: 39145066]
- iommu/amd: Enable support for up to 2K interrupts per function (Kishon Vijay Abraham I) [Orabug: 39145066]
- iommu/amd: Rename DTE_INTTABLEN* and MAX_IRQS_PER_TABLE macro (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Replace slab cache allocator with page allocator (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Introduce generic function to set multibit feature value (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Remove amd_iommu_apply_erratum_63() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Lock DTE before updating the entry with WRITE_ONCE() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Modify clear_dte_entry() to avoid in-place update (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce helper function get_dte256() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Modify set_dte_entry() to use 256-bit DTE helpers (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce helper function to update 256-bit DTE (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce struct ivhd_dte_flags to store persistent DTE flags (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Misc ACPI IVRS debug info clean up (Suravee Suthikulpanit) [Orabug: 39145066]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39250685,39331108] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [Orabug: 39250685]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug: 39250685,39300909] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250685]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le) [Orabug: 39250685]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug: 39250685,39283866,39291972,39292190] {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250685]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers) [Orabug: 39250685]
- iommu/arm-smmu-v3: Handle zeroed A4-2C HTTU override settings (Joao Martins) [Orabug: 39260974]</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.4.el10uek]" date="1778587200">- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39218893]  {CVE-2025-54518}
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39334587]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39334587]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39334587]
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39334587]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39334587]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39334587]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39334587]  {CVE-2026-43284}
- bcm-hsdk-gpl: Fix build issues for HSDK 6.5.34 (Vijay Kumar)  [Orabug: 39342234]
- bcm-hsdk-gpl: Update BCM HSDK GPL driver to 6.5.34 (Vijay Kumar)  [Orabug: 39342234]
- minke-fan-cpld: Avoid logging 'unknown fan id' when no fan is present (arista-hpandya)  [Orabug: 39335238]
- exadata: tools: perf: update column to comm_nodigit (Stephen Brennan)  [Orabug: 39327035]
- perf report: Add comm_nodigit sort key (Stephen Brennan)  [Orabug: 39327035]
- Revert "tools: perf: add comm_ignore_digit column" (Stephen Brennan)  [Orabug: 39327035]
- octeontx2-af: cn20k: Fix RVU AF interrupt handler (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Move QMEM allocations from GFP_KERNEL to ATOMIC (Sunil Goutham)  [Orabug: 39318904]
- bphy-pf: CNF20Ka: poll MHABs based on cpri_mask instead of fixed count (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: Add devlink param for NIX RQ caching (Nishok A)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix the RVUAF-&gt;PF mbox address (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add devlink and debugfs support for NPA DWRR registers. (Anshumali Gaur)  [Orabug: 39318904]
- cn20k-af: psw: Fix build warning (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix AI review comments. (Ratheesh Kannoth)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox to write to PSW MSIX registers (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add debugfs support for psw (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: introduce a mailbox to program PSW mbox msix vector (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add PSW AF API Notification queue support (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add FLR handler for PSW (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setup PSW timed polling structure tables (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW PCIe configuration (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW LF mapping (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add new mailbox for PSW doorbell configuration (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setups PSW FID resources (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setup PSW GID resources (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox to get PSW capabilities (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: register PSW AF interrupts (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: introduce PSW block (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: limit max periodic timers for cn20k (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Make default entries as x4. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeonxt2-af: npc: Fix bugs (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2_unregister_dl() after kernel reboot. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2vf_remove after kernel reboot. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: cn20k: Configure default CPT_AF_UCC_CTL for IPsec error codes (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: CN20k: add support for RFOE4 on half MP (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: Fix kernel crash during eswitch creation (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Use ZERO_OR_NULL_PTR for cgxchan2link_map (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add parser configuration for VLAN extraction (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support for single SBTAG parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix SDP channel base (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add MCS DSA tag parsing configuration support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Avoid any false positives for Altaf (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npc: Fix broadcast MCAM entry type on CN10K (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add platform check. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-bphy-netdev: add get_link_ksettings to fix SIOCETHTOOL error (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: dont free default mcam indexes (Ratheesh Kannoth)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Replace deprecated MSI-X API in CPRI netdev driver (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix kernel warn. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Mismatch stats. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Dont free PF default mcam indexes. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: FIx invalid access (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: dstats (Ratheesh Kannoth)  [Orabug: 39318904]
- octeonxt2-af: npc: cn20k: show enable/disable status. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: debugfs for virtual indexes (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix AI reviews (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Alloc default indexes during nix lf alloc (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix default mcam idx free (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: Remove SoC specific local variables. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix SC resource cleanup loop (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs: Add SC CAM bypass entry (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Modify the pcifunc VF mask (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: update the AFPFX_TRIGX reg offset (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: Fix rvu mbox registers offset (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2: sdp: Display backpressure status in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: add bounds check in nix_bp_enable (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: cn20k: Set a default value for res_meta_offset (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: Support mapping of individual slots to RVU block LFs (Subbaraya Sundeep)  [Orabug: 39318904]
- cn20k-af: ml: improve AF register access control (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: fetch list of LF IDs attached (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: fix using uninitialized partition ID (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable mapping LF to partition ID (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable mapping LF with partitions (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support ML lf alloc and free (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support fetching msix offset for ML (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support attach and detach of ML LFs (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: add support to fetch ML capabilities (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: implement ML mbox message handler (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: register ML interrupt handlers (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: implement hw resource setup and free (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable ML block probe and remove (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: add skeleton code for ML EB driver (Prince Takkar)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Add CN20K TX SecY policy bit support (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs: Set default mcs Id to 0. (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix memleak in npc_install flow (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix flags for HWWQE period timers (Mikko Suni)  [Orabug: 39318904]
- octeontx2-af: cn20k: Use physical address for AF-&gt;PF mbox (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: update fields of CPT_AF_LFX_CTL (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: cn20k: configure RX inline replay (Shashank Gupta)  [Orabug: 39318904]
- Octeontx2-af: cn20k: configure inline RQ mask (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Don't initialize ipsec queues for representor PF. (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-bphy-pf: CNF20ka: BPHY NIC PF driver for chiplet based BPHY NIX bypass mode (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: fix npc mbox structure defination (Mohit Kumar Parjapat)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Avoid SoC specific structures (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix get number of kw (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: cancel work before destroying wq. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx: switch: Fix compiler warnings. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: selftest: Use unique mbox ids (Linu Cherian)  [Orabug: 39318904]
- octeontx: pan: Disable WQ after unregister notifier (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Define new flag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix bugs. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Update mcam_idx for reply flow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Support ovs offloading (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Support mask as well for flow. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Pass tuple mask as well to flow. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Retrieve VLAN infor for L3 routing (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Add vlan tag as part of message (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Dont process events if switchdev is not up (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: make functions static (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix graceful shutdown. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Notify switchdev on NF table callback (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Support SNAT/DNAT routing (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Reject acceleration for invalid bridge (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Fix buffer overflow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix below kernel splat (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switchdev: Register for Route events. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switchdev: Forward route notifications. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switchdev: Add driver support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switchdev: L2 offload support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Remove devlink support for SDP VF NIC driver (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: Handle pool context address update in Aura context write (Ashwin Sekhar T K)  [Orabug: 39318904]
- octeontx2-af: CN20k: fix unused-function warning (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-pf: Move representor event handling into common file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix Rep link state sync up with PF/VFs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Fix DPC config mbox (Ashwin Sekhar T K)  [Orabug: 39318904]
- Octeontx2-pf: Fix transceiver details corruption (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: change GEN PF device ID (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20K: Fetch LBK supported channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix limiting SRIOV VF count logic (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: Fix KASAN slab-out-of-bounds error (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: Update irq affinity for mbox and flr (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add FLR/ME support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Fix possible memleak while mbox init (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Map alternative AF NIX_AF_GINT only for CN10K (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support to forward error interrupts to alt AF (Anil Kumar Reddy)  [Orabug: 39318904]
- octeontx2-af: Add support to forward flr to alternative AF (Anil Kumar Reddy)  [Orabug: 39318904]
- octeontx2-af: Update Alternative AF status (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: cn20k: Cleanup AF interrupt vector (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Do not hardcode AF bus number in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix rsrc_alloc debugfs file (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Add devlink option to reset MAC stats for debugging (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add devlink for defrag initiation (Ratheesh Kannoth)  [Orabug: 39318904]
- net: octeontx2: Fix coding style issues (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: Fix mcs string buffer size (Stefan Wiehler)  [Orabug: 39318904]
- octeontx2-af: Skip TM tree print for disabled SQs (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: debugfs: Add cn20k sdp rings info (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix kernel crash during NIX TM register dump (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: cpt: Add debug support for more than 64 engines. (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Update engine offset calculation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Add support to display "Autoneg" (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-vf: Set tc filter flag on vf netdev (Suman Ghosh)  [Orabug: 39318904]
- Octeontx2-pf: Update link mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-pf: Fix ethtool eeprom read logic (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: ethtool: Display physical connector type (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: restart interface when link settings are changed by user (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-sdpvf: Fix PTP options for SDP interfaces (Roy Franz)  [Orabug: 39318904]
- octeontx2-vf: Add partial ethtool support for SDP VFs (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Add page pool stats to ethtool (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Add missing changes in otx2_ethtool.c (Suman Ghosh)  [Orabug: 39318904]
- Octeontx2-pf: tc: fix egress ratelimiting (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Support to enable EDSA/Higig2 pkts parsing (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Using compound/head page ref count (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Fix NDC sync operation errors (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: cn20k: fix target address (Juan Garcia)  [Orabug: 39318904]
- octeontx2-pf: Check address for Null before free (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Add soft reset sequence in mcs_global_cfg() (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-pf: mcs: Don't account field alignment when installing TX SecY policy (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix start and end bit for scan config (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: npc: cn20k: Remove function (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: npc: cn20k: refactor code (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cgx: misc changes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: reset TL1 SW_XOFF before returning from link mode change (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Remove MAC address validation check (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Show count of dropped packets by DMAC filters (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Update mbox version (Sunil Goutham)  [Orabug: 39318904]
- cn10k-ipsec: Fix compilation with XFRM_OFFLOAD enabled (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-vf: Register dummy netdev for host PF VFs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Configure SQ default channel based on UP message (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Dereference only a valid pointer (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-vf: Fix VF mbox up message error on PTP RX enable (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: Add support for creating netdev interfaces for SDP VFs (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Add more debug messages (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Send UP messages to VF only when VF is up. (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Avoid null pointer dereference (Subbaraya Sundeep)  [Orabug: 39318904]
- cn10k-ipsec: fix uninitialized send queue during ESP offload (Shashank Gupta)  [Orabug: 39318904]
- cn10k-ipsec: Initialize ipsec queues on enabling IPsec (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: cn10k/cn20k: Update count_eot in NPA_LF_AURA_BATCH_FREE0 (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: persist netdev stats across routine operations (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-pf: Add self test (Linu Cherian)  [Orabug: 39318904]
- octeontx2-pf: Add ethtool -m option support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Skip dma map and unmap when IOMMU is bypassed (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-pf: Add NIXLF error/poison interrupt handlers (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-pf: Validation for TL1 Round robin priority (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: devlink param support to modify physical interface links. (Rakesh Babu)  [Orabug: 39318904]
- octeontx2-pf: Add devlink param to vary rbuf size (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Add devlink param to vary cqe size (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: CN20k: add multi chiplet support to NIX path (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Enable TX PTP timestamping on BPHY NIX link (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cn10k: Fix accessing invalid CSRs (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: fix fwdata NULL pointer dereference when RPM probe fails (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Map BPHY chiplet RPMs followed by compute chiplet RPMs (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Add chiplet RPM AF mbox support for port ready, get channel info messages. (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cnf20k: account for XCB RPM links in CGX link calculation (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Add support for chiplet based BPHY RPM driver as AF RVU extension block module (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Add BPHY chiplet, RPM, LMAC data to fwdata (Sai Krishna)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Register driver with PCI subsys ID (Anshumali Gaur)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Fix MSI-X init failure by setting both DMA masks (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20K: Add build and config support for CPRI PF driver to avoid module conflicts (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Fix CPRI MSI-X initialization failure (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Add workaround for gpint issue for CPRI pkt path (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Add cpri netdev driver support (Viswajith Murali)  [Orabug: 39318904]
- octeontx-bphy-netdev: Fix unexpected packet in netdev by ensuring proper PSW hardware write handling (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-bphy-netdev: allow forcing ts steps cnt (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix fec counters reporting (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix ecpri pkt stats update (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix ecpri type5 handling (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix a deadlock in cpri (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix race condition for timestamp packets (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix kernel crash by using proper max PSM queue count (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: protect psm queue access (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix debugfs memleak (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Detect DL circular buffer full (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix rsfec stats reading (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Support for eCPRI MsgType5 timestamping (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Use correct netdev priv structure for debugging (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: disable CPRI RX on cleanup (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: ignore mcs untagged error (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: disable rx on RFOEs on exit (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix crash issue during initialization of cpri, rfoe interfaces on set MAC address (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: OcteonTX2 Base PHY RFOE netdev driver (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver msix, interrupt handling (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Move DPI block reset handling to AF extension block driver (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver channel table mbox support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver mbox support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver initial support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cn20k: Don't reset the PF_DISC register (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: CN20K: update RPM links (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add block discovery register (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix PTP RX enable mbox fail issue over NIC VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Modify NIX register offset value for CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Validate NIX maximum LFs correctly (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix incorrect BPID initialization for CPT channels (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow CPT PF access to CPT_AF_GRPX_THR (Shashank Gupta)  [Orabug: 39318904]
- octeontx2-af: cn20k: support packet data buffer (pdb) configuration (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Set LBK channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix config parameter check when disable inline queue (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable CPT parse and Frag info header byte swap (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Add an MCAM entry to count CPT 2nd pass miss packets (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: support overriding aura to zero for second pass (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Use proper mask to get max CPT LF's (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: allow mbox access from CPT VFs for backward compatibility (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: Drop CPT PF/VF check for relevant mboxes (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Change CPT channels configuration (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow CPT PF access to CPTX_AF_CTX_PSP_TIMER_CTL (Shashank Gupta)  [Orabug: 39318904]
- octeontx2-af: cn20k: change CPT register address as per latest csr (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow access to CPT_AF_UCCX_CTL (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: CN20K channel configuration (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable RXC on inline inbound cptlf (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix RXC flush and cleanup sequence (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add CPT CTX flush support (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: fix CPT ctx flush (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: cn20k: Setup CPT reassembly Queue Configuration Register (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Move RXC specific functions (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: cn20k: handle multi-queue reassembly teardown (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for NIX RX inline configuration (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for CPT RX inline configuration (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for CPT RX queue allocation (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mbox to configure rx inline nixlf (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mbox to configure rx inline profile (Bharat Bhushan)  [Orabug: 39318904]
- crypto: octeontx2: Add new mailbox to set queue priority (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add rxc teardown support (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add queue id to rxc time config mbox (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add cpt stats mailbox support (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: add FLT interrupts (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: Unify HW interrupt APIs (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx-af: cpt: Get CPT PF number using PF Device ID (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Update max engine calculation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Add TC rules support for CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Set correct sequence for carrier off and tx queue stop (Suman Ghosh)  [Orabug: 39318904]
- octeontx2: Fix klockwork issues. (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Free queue memory allocated sq timestamp (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Check for DMAC extraction support before setting DMAC based hardware filter for a VF (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Move REP devlink APIs to separate file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix representor up notification events (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Use ews_rules value to update REP tcam rules (Geetha sowjanya)  [Orabug: 39318904]
- Octeontx2-af: Change args for rvu_get_pf (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add validation before accessing fwdata (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: map management port always to first PF (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: replace generic error codes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: link mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Assign CGX id from PCI revision id (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Remove MAC address validation check (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: lmac validation with is_lmac_valid (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix compilation warning/klockwork issues (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: configure 802.3 pause frames in SGMII/QSGMII mode (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add new CGX_CMDs to set and get PHY modulation type (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Do not allow VFs to overwrite PKIND config (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Put CGX LMAC also in Higig2 mode (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-sdp: Add FLR interrupts for Host PFs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Refactor SDP interrupts code (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Fix SDP channel numbers in NPC rules (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Check whether SDP block is present before access (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: sdp: Fix address range assignment logic (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: sdp: Maintain host to RVU GEN PF mapping (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: misc SDP fixes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx-af: cn20k: Manage rings allocation and freeing (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: CN20K: SDP mbox framework (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: CN20K: SDP extension driver (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-pf: enable AF_XDP zero copy support (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix clearing TL3_TL2X_LINKX_CFG[ENA] during SMQ flush to drop packets (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Fix ROCEV2 RSS hashing QP ID length (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Allow to set CPT result address offset (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for NIX flow vector configuration (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: add ROCEv2 header for RSS hashing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Update lbk maximum frame size as per CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: fix TX scheduler count (Satha Rao)  [Orabug: 39318904]
- octeontx2-af: Fix the issue of infinite loop in nix_aq_reset (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Misc changes in NIX block (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Dump hw register state on error (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add new mailbox to configure LSO alt flags (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Extend SPI to SA index translation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: notify VF about ptp event (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: Sending tsc value to the userspace (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: Support for PTP notification to PF (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: npa: fix DPC permit register access (Ashwin Sekhar T K)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add DPC support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add debugfs support for Halo (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add NPA Halo support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Fix number of entries in the kpu3 cam (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix subbank count (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix number of entries in the kpu2 cam (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add mbox to read default rule (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: kpu: Input validation check. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: kpu: Fix lodable profile issue (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Convert to C99 flexible array (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Restore stats in defrag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Flow delete and free mbox (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Add traces in NPC mailboxes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix KPU9 state variable for ROCEV2 (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add support for ROCEv2 header parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add more VLAN tag parsing in case of E-tag (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flags for cn20k (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Avoid updating cn10k registers during cn20k reboot (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Do not access match stats for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: Update NPC CSRs (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix out of bound access in entry2counter array (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix initialization of mcam's entry2target_pffunc field (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flag extraction in parse nibble (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix CPT CGX channel mask for cn20k (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flag in KPU profile for CN20K (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: fix mcam hit counter (Satheesh Paul)  [Orabug: 39318904]
- Revert "octeontx2-af: npc: cn20k: Get base steer rule index." (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: fix rule type for LBK VF (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: Fix failed to load custom pfl warning (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: add changes to update CPT pad length offset in KPU (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix search order (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: Use dev_dbg() (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix compilation warnings (Sunil Goutham)  [Orabug: 39318904]
- octeontx2: cn20k: npc: Set action2 for x2 entries. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable action2 programming in npc (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Set default profile DYNAMIC (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix csr register field offset. (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Reject request for x4 entries in x2 profile. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Alloc mcam entry for install flow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Disable fw load faiure warning (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Load custom kpu profile from filesystem. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix install flow priority (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add support for custom mkex profiles (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Get base steer rule index. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Stats support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cn20k: Reject mcam alloc mbox with invalid keytype (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Reserve x4 key mcam entries for ntuple (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Get kex related info from PF. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix parse result nibble mask reading. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Set correct nibble bits for cn20k (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix parse nibble mask (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Avoid accessing cn10k registers (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add new mailboxes for CN20K silicon (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix npc_mcam_get_hit_status mbox for cn10k (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Convert vidx to mcam_idx in mbox handler (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add an mbox interface to defrag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: defragmentation support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Introduce virtual mcam index (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Validate mcam index before enable/disable (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add new mailboxes to get kex config and free counts (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Use common APIs to read/write/copy/enable mcam entry (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Add a new mbox to read/write MCAM hit status (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: debugfs support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Use common APIs to alloc/free/get mcam index. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Allocate default mcam indexes. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Modify alloc entry mailbox (Suman Ghosh)  [Orabug: 39318904]
- ocetontx2-af: npc: cn20k: MKEX profile support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: KPM profile changes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Index management. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: Fix klockwork issues. (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix Support of FDSA tag (George Cherian)  [Orabug: 39318904]
- octeontx2-af: Support for FDSA tag (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Adding changes to parse stacked VLANs (Kiran Kumar K)  [Orabug: 39318904]
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix issue with GRE parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add support to parse more VLAN headers (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix issue with IPV6 GRE and multi VLAN (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add KPU changes to parse fabric path header (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add few missing changes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: allow second pass pkts via default ucast entry (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: suppress kpu profile loading warning (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: use cpt channel mask in flow install path (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: Add NPC support to filter GTP-U and GTP-C packets based on TEID (Suman Ghosh)  [Orabug: 39318904]
- octeontx2: cn20k: Assign unique MCS IDs based on PCI enumeration (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-pf: Choose macsec encryption offload per packet (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: mcs: Use new SCI CAM in hardware (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: mcs: Fix mcs resources free on PF shutdown (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Add devlink parameter to toggle MCS bypass mode (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Display port mapped stats for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add MCS LMAC channel and count configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs set mcs id and silicon check (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix mcs tx_sa_map API (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mcs PN threshold support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: MCS add port configure APIs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: Add MCS parser configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix mcs register offsets (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix unsupported secy stats read (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add MCS support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: mcs: Remove SA stats support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cnf10k-b: mcs: Fix stats reg address (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: rvu: enable mcs fips mailboxes (Ankur Dwivedi)  [Orabug: 39318904]
- octeontx2-af: mcs: add mailboxes for fips (Ankur Dwivedi)  [Orabug: 39318904]
- octeontx2-af: sso: clear all the sets on init (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: tim: add ring priority support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: update TIM interval support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: moderate SSO AF error interrupts (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: lower TIM bucket skip IRQ log level (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: remove GTI clock adjustment (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: update xaq aura offset (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: cleanup SSO EVA on LF reset (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO HW info mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO AGGR config and stats mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO EVA error interrupts (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: update masks for CN20K resources (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: Fixed compilation warnings (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: fix interval flag check (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add TIM hardware info mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add TIM HWWQE mbox support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add mbox to capture counters (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: reveal only TIM params that are available (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: add TIM error af interrupt handlers (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: clear state on TIM ring disable (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: disable preemption when enabling TIM (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: account for cycle wraparound (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: prevent TIM register read reorder (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: fix arguments passed to XAQ aura deinit (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: debugfs: fix undefined SSO register access (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: update TIM adjust GTI errata silicons (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: update TIM adjust GTI errata silicons (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: add TIM adjust GTI errata workaround (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: cn10k: devlink params to configure TIM (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: TIM: Set conditional clock always on (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Apply relevant HW issue workarounds for 96xx B0 silicon (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: Add SSO and TIM units support to the AF driver (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: enable rxc with lookaside cpt lf (Vidya Sagar Velumuri)  [Orabug: 39318904]
- octeontx2-af: fix issue with spitosa table teardown (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: fix cflags include paths (Wladislav Wiebe)  [Orabug: 39318904]
- octeontx2-af: Move out REE mbox messages (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add generic mbox handler for Eblock (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Use AF extension block interface (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add RVU AF extension block interface (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Introducing REE block for 98xx (Smadar Fuks)  [Orabug: 39318904]
- octeontx2-af: fix VF bringup affecting PF promiscous state (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: consider mode when using cpt base channel for bp (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: Update minimum receive frame size (Sathesh Edara)  [Orabug: 39318904]
- octeontx2-af: set default min and max rx len for CPT link (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: add NIX mbox message to get HW info (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: fix inline inbound IPsec configuration (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: support for custom L2 header (Satheesh Paul A)  [Orabug: 39318904]
- octeontx2-af: fix to get different rq mask (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: poll for tx link credits before link mode change (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Handle physical link state change requests (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add mbox to alloc/free BPIDs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Dynamically allocate bpids for CPT and LBK (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support for SPI to SA index translation (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Update HW workarounds for 96xx C0, 98xx and F95xx B0 chips (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add devlink support to configure TL1 RR_PRIO (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: add support for CPT second pass (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: add new mbox to support sync cycle on rx path (Satha Rao)  [Orabug: 39318904]
- octeontx2-af: add support for changing vlan tpid (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-pf: Fix devm_kcalloc() error checking (Dan Carpenter)  [Orabug: 39318904]
- octeontx2-pf: Use new bandwidth profiles in receive queue (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Display new bandwidth profiles too in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Accommodate more bandwidth profiles for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Initialize new NIX SQ context for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Initialize cn20k specific aura and pool contexts (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Skip NDC operations for cn20k (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Extend debugfs support for cn20k NPA (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add cn20k NPA block contexts (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Extend debugfs support for cn20k NIX (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Add cn20k NIX block contexts (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Simplify context writing and reading to hardware (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: convert to ndo_hwtstamp API (Vadim Fedorenko)  [Orabug: 39318904]
- Octeontx2-af: Fix pci_alloc_irq_vectors() return value check (Harshit Mogalapalli)  [Orabug: 39318904]
- Octeontx2-af: Fix missing error code in cgx_probe() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-pf: fix bitmap leak (Bo Sun)  [Orabug: 39318904]
- octeontx2-vf: fix bitmap leak (Bo Sun)  [Orabug: 39318904]
- octeontx2-af: Remove unused declarations (Yue Haibing)  [Orabug: 39318904]
- Octeontx2-af: Fix NIX X2P calibration failures (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-vf: Fix max packet length errors (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Broadcast XON on all channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: use unsigned int as iterator for unsigned values (Simon Horman)  [Orabug: 39318904]
- net: Fix typos (Bjorn Helgaas)  [Orabug: 39318904]
- Octeontx2-af: Debugfs support for firmware data (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: RPM: Update DMA mask (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Disable stale DMAC filters (Subbaraya Sundeep)  [Orabug: 39318904]
- Octeontx2-af: Add programmed macaddr to RVU pfvf (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix error code in rvu_mbox_init() (Dan Carpenter)  [Orabug: 39318904]
- Octeontx2-pf: ethtool: support multi advertise mode (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Introduce mode group index (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx-pf: Update SGMII mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix rvu_mbox_init return path (Subbaraya Sundeep)  [Orabug: 39318904]
- Octeontx2-pf: Fix Backpresure configuration (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: CN20K mbox implementation between PF-VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20K mbox implementation for AF's VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: CN20K mbox REQ/ACK implementation for NIC PF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k mbox to support AF REQ/ACK functionality (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k basic mbox operations and structures (Sai Krishna)  [Orabug: 39318904]
- octeontx2: Set appropriate PF, VF masks and shifts based on silicon (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Avoid typecasts by simplifying otx2_atomic64_add macro (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Annotate mmio regions as __iomem (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: macsec: Get MACSEC capability flag from AF (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Add MACSEC capability flag (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Send Link events one by one (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: NPC: Clear Unicast rule on nixlf detach (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Avoid adding dcbnl_ops for LBK and SDP vf (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Add tracepoint for NIX_PARSE_S (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Add new tracepoint otx2_msg_status (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Add pcifunc also to mailbox tracepoints (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Display names for CPT and UP messages (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: convert dev_dbg to tracepoint in mbox (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Fix ethtool support for SDP representors (Hariprasad Kelam)  [Orabug: 39318904]
- net: octeontx2: Use pure PCI devres API (Philipp Stanner)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP: code clean up (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Remove unused rvu_npc_enable_bcast_entry (Dr. David Alan Gilbert)  [Orabug: 39318904]
- xfrm: Add explicit dev to .xdo_dev_state_{add,delete,free} (Cosmin Ratiu)  [Orabug: 39318904]
- octeontx2-pf: handle otx2_mbox_get_rsp errors (Chenyuan Yang)  [Orabug: 39318904]
- net: octeontx2: Handle XDP_ABORTED and XDP invalid as XDP_DROP (Lorenzo Bianconi)  [Orabug: 39318904]
- octeontx2-af: mcs: Remove redundant 'flush_workqueue()' calls (Chen Ni)  [Orabug: 39318904]
- net: octeontx2: Add metadata support for xdp mode (Lorenzo Bianconi)  [Orabug: 39318904]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 39318904]
- octeontx2: hide unused label (Arnd Bergmann)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP zero copy transmit support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Prepare for AF_XDP (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Reconfigure RSS table after enabling AF_XDP zerocopy on rx queue (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP zero copy receive support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: use xdp_return_frame() to free xdp buffers (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: mcs: Remove dead code and semi-colon from rsrc_name() (Nihar Chaithanya)  [Orabug: 39318904]
- octeontx2-pf: fix error handling of devlink port in rvu_rep_create() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-pf: fix netdev memory leak in rvu_rep_create() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-af: fix build regression without CONFIG_DCB (Arnd Bergmann)  [Orabug: 39318904]
- cn10k-ipsec: Fix compilation error when CONFIG_XFRM_OFFLOAD disabled (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Fix installation of PF multicast rule (Geetha sowjanya)  [Orabug: 39318904]
- cn10k-ipsec: Enable outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Allow ipsec crypto offload for skb with SA (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Process outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Add SA add/del support for outb ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Init hardware for outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Disable backpressure between CPT and NIX (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Move skb fragment map/unmap to common code (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: map skb data as device writeable (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Fix SDP MAC link credits configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Fix spelling mistake "reprentator" -&gt; "representor" (Colin Ian King)  [Orabug: 39318904]
- octeontx2-pf: Adds TC offload support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Implement offload stats ndo for representors (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add devlink port support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add representors for sdp MAC (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Configure VF mtu via representor (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add support to sync link state between representor and VFs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Get VF stats via representor (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add packet path between representor and VF (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add basic net_device_ops (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Create representor netdev (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: RVU representor driver (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Knobs for NPC default rule counters (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Refactor few NPC mcam APIs (Linu Cherian)  [Orabug: 39318904]
- octeontx2-pf: Move shared APIs to header file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Reuse PF max mtu value (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add new APIs for queue memory alloc/free. (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Define common API for HW resources configuration (Geetha sowjanya)  [Orabug: 39318904]
- net: marvell: use ethtool string helpers (Rosen Penev)  [Orabug: 39318904]
- uek: kabi: update kABI files for new symbols (Saeed Mirzamohammadi)  [Orabug: 39268116]
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39167615]  {CVE-2026-31402}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39110670]  {CVE-2026-23278}
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39103229]  {CVE-2026-23270}</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.5.el10uek]" date="1779192000">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39407652]  {CVE-2026-46333}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.6.el10uek]" date="1779796800">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39442660]  {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39442660]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.7.el10uek]" date="1779969600">- tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi)  [Orabug: 39456024]
- tap: free page on error paths in tap_get_user_xdp() (Weiming Shi)  [Orabug: 39456024]
- tun: free page on short-frame rejection in tun_xdp_one() (Weiming Shi)  [Orabug: 39456024]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.7.1.el10uek]" date="1780315200">- smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39474418]</changelog>
</package>
<package pkgid="d0d6bddb4c458de59d0c95940655ded9a89e60b9" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="100.28.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.2.el10uek]" date="1751198400">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
</package>
<package pkgid="9c4ecb7c186e795c6072b672891f45755ac52803" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="100.28.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.el10uek]" date="1743681600">- block: prevent calls to should_fail_bio() optimized by gcc (Prasad Singamsetty)  [Orabug: 37782458]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)   
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]  
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]  
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
</package>
<package pkgid="c43d79816985a5f3117991b69c43220ed1a36ca8" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="101.33.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge) [Orabug: 37976747] {CVE-2025-37903}
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi) [Orabug: 37976752] {CVE-2025-37905}
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [Orabug: 37976858] {CVE-2025-37932}
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski) [Orabug: 37976760] {CVE-2025-37907}
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang) [Orabug: 37976762] {CVE-2025-37908}
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh Edara) [Orabug: 37976864] {CVE-2025-37933}
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan) [Orabug: 37976765] {CVE-2025-37909}
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon) [Orabug: 37976771] {CVE-2025-37910}
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang) [Orabug: 37976728] {CVE-2025-37894}
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein) [Orabug: 37976869] {CVE-2025-37934}
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab) [Orabug: 37976773] {CVE-2025-37911}
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh Ap)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya Kn) [Orabug: 37976731] {CVE-2025-37895}
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe) [Orabug: 37976872] {CVE-2025-37935}
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai) [Orabug: 37970918] {CVE-2025-37891}
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Luoxuanqiang) [Orabug: 37976779] {CVE-2025-37912}
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976783] {CVE-2025-37913}
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976788] {CVE-2025-37914}
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira) [Orabug: 37970915] {CVE-2025-37890}
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976792] {CVE-2025-37915}
- pds_core: remove write-after-free of client_id (Shannon Nelson) [Orabug: 37976797] {CVE-2025-37916}
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud) [Orabug: 37976802] {CVE-2025-37917}
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu) [Orabug: 37976804] {CVE-2025-37918}
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu) [Orabug: 37976806] {CVE-2025-37919}
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (Eryk Kubanski) [Orabug: 37976809] {CVE-2025-37920}
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel) [Orabug: 37976815] {CVE-2025-37921}
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov) [Orabug: 37976734] {CVE-2025-37897}
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom) [Orabug: 37976819] {CVE-2025-37922}
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Sun Peng Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park) [Orabug: 37976821] {CVE-2025-37923}
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan) [Orabug: 37976738] {CVE-2025-37899}
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan) [Orabug: 37976828] {CVE-2025-37924}
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon) [Orabug: 37976832] {CVE-2025-37926}
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen) [Orabug: 37976741] {CVE-2025-37900}
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov) [Orabug: 37976836] {CVE-2025-37927}
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (Longping Wei) [Orabug: 37976844] {CVE-2025-37928}
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Xu Wang) [Orabug: 37977118] {CVE-2025-37990}
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold) [Orabug: 37976744] {CVE-2025-37901}
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson) [Orabug: 37976874] {CVE-2025-37936}
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller) [Orabug: 37977127] {CVE-2025-37991}
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon) [Orabug: 37977182] {CVE-2025-37929}
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner) [Orabug: 37976850] {CVE-2025-37930}
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik) [Orabug: 37976853] {CVE-2025-37931}
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya) [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil) [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert) [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter) [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King) [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche) [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert) [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar) [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang) [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli) [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre) [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta) [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon) [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon) [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth) [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth) [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick) [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli) [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval) [Orabug: 37930100] {CVE-2025-37821}
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang) [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed) [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan) [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.31.1.el10uek]" date="1748952000">- LTS version: v6.12.31 (Jack Vogel)
- drm/gem: Internally test import_attach for imported objects (Thomas Zimmermann)
- x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers (Balbir Singh)
- i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() (Nathan Chancellor)
- pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group() (Dan Carpenter)
- watchdog: aspeed: fix 64-bit division (Arnd Bergmann)
- drm/amdkfd: Correct F8_MODE for gfx950 (Amber Lin)
- serial: sh-sci: Save and restore more registers (Geert Uytterhoeven)
- bpf: abort verification if env-&gt;cur_state-&gt;loop_entry != NULL (Eduard Zingerman)
- drm/amd/display: Exit idle optimizations before accessing PHY (Ovidiu Bunea)
- kbuild: Properly disable -Wunterminated-string-initialization for clang (Nathan Chancellor)
- Fix mis-uses of 'cc-option' for warning disablement (Linus Torvalds)
- gcc-15: disable '-Wunterminated-string-initialization' entirely for now (Linus Torvalds)
- gcc-15: make 'unterminated string initialization' just a warning (Linus Torvalds)
- err.h: move IOMEM_ERR_PTR() to err.h (Raag Jadav)
- spi: spi-fsl-dspi: Reset SR flags before sending a new message (Larisa Grigore)
- spi: spi-fsl-dspi: Halt the module after a new message transfer (Bogdan-Gabriel Roman)
- spi: spi-fsl-dspi: restrict register range for regmap access (Larisa Grigore)
- spi: use container_of_cont() for to_spi_device() (Greg Kroah-Hartman)
- platform/x86: think-lmi: Fix attribute name usage for non-compliant items (Mark Pearson)
- ksmbd: fix stream write failure (Namjae Jeon)
- Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection" (Jernej Skrabec)
- Bluetooth: btmtksdio: Do close if SDIO card removed without close (Chris Lu)
- Bluetooth: btmtksdio: Check function enabled before doing close (Chris Lu)
- nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() (Ryusuke Konishi)
- mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled (Ignacio Moreno Gonzalez)
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Tianyang Zhang)
- memcg: always call cond_resched() after fn() (Breno Leitao)
- highmem: add folio_test_partial_kmap() (Matthew Wilcox)
- Input: xpad - add more controllers (Vicki Pfau)
- Revert "drm/amd: Keep display off while going into S4" (Mario Limonciello)
- smb: client: Reset all search buffer pointers when releasing buffer (Zhaolong Wang)
- arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (Gabor Juhos)
- smb: client: Fix use-after-free in cifs_fill_dirent (Zhaolong Wang) [Orabug: 38094970] {CVE-2025-38051}
- drm/edid: fixed the bug that hdr metadata was not reset (Feijuan Li)
- thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature (Zhang Rui)
- platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin) [Orabug: 38095141] {CVE-2025-38077}
- pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
- pmdomain: renesas: rcar: Remove obsolete nullify checks (Geert Uytterhoeven)
- vmxnet3: update MTU after device quiesce (Ronak Doshi)
- net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
- can: kvaser_pciefd: Fix echo_skb race (Axel Forsman)
- can: kvaser_pciefd: Continue parsing DMA buf after dropped RX (Axel Forsman)
- llc: fix data loss when reading from a socket in llc_ui_recvmsg() (Gavrilov Ilia)
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10 (Ed Burcher)
- ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [Orabug: 38095145] {CVE-2025-38078}
- ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction (Peter Ujfalusi)
- ASoc: SOF: topology: connect DAI to a single DAI link (Kai Vehmanen)
- ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext (Peter Ujfalusi)
- can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp) [Orabug: 38049369] {CVE-2025-38003}
- can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 38049374] {CVE-2025-38004}
- can: slcan: allow reception of short error messages (Carlos Sanchez)
- padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094842] {CVE-2025-38031}
- crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [Orabug: 38095153] {CVE-2025-38079}
- clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe() (André Draszik)
- octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG (Geetha Sowjanya)
- octeontx2-af: Set LMT_ENA bit for APR table entries (Subbaraya Sundeep)
- net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang) [Orabug: 38094978] {CVE-2025-38052}
- octeontx2-pf: Add AF_XDP non-zero copy support (Suman Ghosh)
- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [Orabug: 38049357] {CVE-2025-38000}
- idpf: fix idpf_vport_splitq_napi_poll() (Eric Dumazet)
- io_uring: fix overflow resched cqe reordering (Pavel Begunkov)
- net: lan743x: Restore SGMII CTRL register on resume (Thangaraj Samynathan)
- net: dwmac-sun8i: Use parsed internal PHY address instead of 1 (Paul Kocialkowski)
- pinctrl: qcom: switch to devm_register_sys_off_handler() (Dmitry Baryshkov)
- loop: don't require -&gt;write_iter for writable files in loop_configure (Christoph Hellwig)
- idpf: fix null-ptr-deref in idpf_features_check (Pavan Kumar Linga) [Orabug: 38094982] {CVE-2025-38053}
- ice: Fix LACP bonds without SRIOV environment (Dave Ertman)
- ice: fix vf-&gt;num_mac count with port representors (Jacob Keller)
- bridge: netfilter: Fix forwarding of fragmented packets (Ido Schimmel)
- ptp: ocp: Limit signal/freq counts in summary output functions (Sagi Maimon) [Orabug: 38094984] {CVE-2025-38054}
- Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling (En-Wei Wu)
- Bluetooth: L2CAP: Fix not checking l2cap_chan security level (Luiz Augusto von Dentz)
- perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter) [Orabug: 38094988] {CVE-2025-38055}
- irqchip/riscv-imsic: Start local sync timer on correct CPU (Andrew Bresticker)
- ASoC: SOF: Intel: hda: Fix UAF when reloading module (Tavian Barnes) [Orabug: 38094991] {CVE-2025-38056}
- devres: Introduce devm_kmemdup_array() (Raag Jadav)
- driver core: Split devres APIs to device/devres.h (Andy Shevchenko)
- dmaengine: fsl-edma: Fix return code for unhandled interrupts (Stefan Wahren)
- dmaengine: idxd: Fix -&gt;poll() return value (Dave Jiang)
- xfrm: Sanitize marks before insert (Paul Chaignon)
- clk: sunxi-ng: d1: Add missing divider for MMC mod clocks (Andre Przywara)
- remoteproc: qcom_wcnss: Fix on platforms without fallback regulators (Matti Lehtimäki)
- kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() (David Hildenbrand)
- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (Seongman Lee)
- dmaengine: idxd: Fix allowing write() from different address spaces (Vinicius Costa Gomes)
- xfrm: Fix UDP GRO handling for some corner cases (Tobias Brunner)
- espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca)
- espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094993] {CVE-2025-38057}
- soundwire: bus: Fix race on the creation of the IRQ domain (Charles Keepax)
- __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [Orabug: 38095000] {CVE-2025-38058}
- drm/amd/display: Call FP Protect Before Mode Programming/Mode Support (Austin Zheng)
- xenbus: Allow PVH dom0 a non-local xenstore (Jason Andryuk)
- x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust &gt;= 1.88 (Paweł Anikiel) [Orabug: 38094847] {CVE-2025-38033}
- wifi: iwlwifi: add support for Killer on MTL (Johannes Berg)
- block: only update request sector if needed (Johannes Thumshirn)
- tools: ynl-gen: validate 0 len strings from kernel (David Wei)
- btrfs: avoid NULL pointer dereference if no valid csum tree (Qu Wenruo) [Orabug: 38095010] {CVE-2025-38059}
- btrfs: handle empty eb-&gt;folios in num_extent_folios() (Boris Burkov)
- btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [Orabug: 38094856] {CVE-2025-38034}
- btrfs: compression: adjust cb-&gt;compressed_folios allocation type (Kees Cook)
- ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers (Stefan Binding)
- cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function (Pali Rohár)
- cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info() (Pali Rohár)
- io_uring/fdinfo: annotate racy sq/cq head/tail reads (Jens Axboe)
- nvmet-tcp: don't restore null sk_state_change (Alistair Francis) [Orabug: 38094863] {CVE-2025-38035}
- ALSA: usb-audio: Fix duplicated name in MIDI substream names (Takashi Iwai)
- nvme-pci: add quirks for WDC Blue SN550 15b7:5009 (Guan Wentao)
- nvme-pci: add quirks for device 126f:1001 (Guan Wentao)
- ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 (Takashi Iwai)
- ASoC: cs42l43: Disable headphone clamps during type detection (Charles Keepax)
- platform/x86: ideapad-laptop: add support for some new buttons (Gašper Nemgar)
- platform/x86: asus-wmi: Disable OOBE state after resume from hibernation (Pavel Nikulin)
- platform/x86/intel: hid: Add Pantherlake support (Saranya Gopal)
- smb: server: smb2pdu: check return value of xa_store() (Salah Triki)
- pinctrl: meson: define the pull up/down resistor value as 60 kOhm (Martin Blumenstingl)
- book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n (Ritesh Harjani)
- ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of() (Chenyuan Yang)
- drm: Add valid clones check (Jessica Zhang)
- drm/panel-edp: Add Starry 116KHD024006 (Douglas Anderson)
- drm/buddy: fix issue that force_merge cannot free all roots (Lin Cao)
- drm/atomic: clarify the rules around drm_atomic_state-&gt;allow_modeset (Simona Vetter)
- drm/xe: Reject BO eviction if BO is bound to current VM (Oak Zeng)
- drm/xe/sa: Always call drm_suballoc_manager_fini() (Michal Wajdeczko)
- wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event (Ching-Te Ku)
- drm/xe: Do not attempt to bootstrap VF in execlists mode (Maarten Lankhorst)
- drm/xe: Move suballocator init to after display init (Maarten Lankhorst)
- wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (P Praneesh)
- drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE (Zhi Wang)
- drm: bridge: adv7511: fill stream capabilities (Olivier Moysan)
- wifi: ath12k: Fix end offset bit definition in monitor ring descriptor (P Praneesh)
- wifi: ath12k: Fetch regdb.bin file from board-2.bin (Aaradhana Sahu)
- wifi: ath9k: return by of_get_mac_address (Rosen Penev)
- drm/xe/pf: Reset GuC VF config when unprovisioning critical resource (Michal Wajdeczko)
- accel/qaic: Mask out SR-IOV PCI resources (Youssef Samir)
- wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override (Nicolas Escande)
- regulator: ad5398: Add device tree support (Isaac Scott)
- spi: zynqmp-gqspi: Always acknowledge interrupts (Sean Anderson)
- wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet (Ping-Ke Shih)
- wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate (Bitterblue Smith)
- wifi: rtl8xxxu: retry firmware download on error (Soeren Moch)
- clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation (Lad Prabhakar)
- perf/amd/ibs: Fix -&gt;config to sample period calculation for OP PMU (Ravi Bangoria)
- perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (Ravi Bangoria)
- firmware: arm_scmi: Relax duplicate name constraint across protocol ids (Sudeep Holla)
- bpftool: Fix readlink usage in get_fd_type (Viktor Malik)
- bpf: Use kallsyms to find the function name of a struct_ops's stub function (Martin Kafai Lau)
- drm/ast: Find VBIOS mode from regular display size (Thomas Zimmermann)
- dm vdo: use a short static string for thread name prefix (Matthew Sakai)
- dm vdo indexer: prevent unterminated string warning (Chung Chung)
- irqchip/riscv-aplic: Add support for hart indexes (Vladimir Kondratiev)
- ASoC: rt722-sdca: Add some missing readable registers (Charles Keepax)
- ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode (Cezary Rojewski)
- arm64: zynqmp: add clock-output-names property in clock nodes (Naman Trivedi Manojbhai)
- HID: usbkbd: Fix the bit shift number for LED_KANA (Junan)
- wifi: ath12k: Avoid napi_sync() before napi_enable() (Avula Sri Charan)
- scsi: st: Restore some drive settings after reset (Kai Mäkisara)
- net/mana: fix warning in the writer of client oob (Konstantin Taranov)
- drm/xe/relay: Don't use GFP_KERNEL for new transactions (Michal Wajdeczko)
- ice: count combined queues using Rx/Tx count (Michal Swiatkowski)
- perf: Avoid the read if the count is already updated (Peter Zijlstra)
- rcu: fix header guard for rcu_all_qs() (Ankur Arora)
- rcu: handle unstable rdp in rcu_read_unlock_strict() (Ankur Arora)
- rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y (Ankur Arora)
- ice: treat dyn_allowed only as suggestion (Michal Swiatkowski)
- ice: init flow director before RDMA (Michal Swiatkowski)
- bridge: mdb: Allow replace of a host-joined group (Petr Machata)
- net: flush_backlog() small changes (Eric Dumazet)
- r8169: don't scan PHY addresses &gt; 0 (Heiner Kallweit)
- ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only (Geert Uytterhoeven)
- vxlan: Annotate FDB data races (Ido Schimmel) [Orabug: 38094879] {CVE-2025-38037}
- cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (Dhananjay Ugwekar) [Orabug: 38094888] {CVE-2025-38038}
- tools: ynl-gen: don't output external constants (Jakub Kicinski)
- eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs (Alexander Duyck)
- drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0 (Cristian Ciocaltea)
- media: qcom: camss: Add default case in vfe_src_pad_code (Depeng Shao)
- media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available (Depeng Shao)
- f2fs: introduce f2fs_base_attr for global sysfs entries (Jaegeuk Kim)
- hwmon: (xgene-hwmon) use appropriate type for the latency value (Andrey Vatoropin)
- tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options (Len Brown)
- net: page_pool: avoid false positive warning if NAPI was never added (Jakub Kicinski)
- clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs (Jordan Crouse)
- wifi: rtw89: call power_on ahead before selecting firmware (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before accessing (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before getting its size (Ping-Ke Shih)
- wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang (Ching-Te Ku)
- wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix download_firmware_validate() for RTL8814AU (Bitterblue Smith)
- ext4: remove writable userspace mappings before truncating page cache (Zhang Yi)
- ext4: don't write back data before punch hole in nojournal mode (Zhang Yi)
- leds: trigger: netdev: Configure LED blink interval for HW offload (Marek Vasut)
- pstore: Change kmsg_bytes storage size to u32 (Kees Cook)
- iio: adc: ad7944: don't use storagebits for sizing (David Lechner)
- r8152: add vendor/device ID pair for Dell Alienware AW1022z (Aleksander Jan Bajkowski)
- ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). (Kuniyuki Iwashima)
- arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src (Athira Rajeev)
- powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (Gaurav Batra)
- powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Gaurav Batra)
- net: fec: Refactor MAC reset to function (Csókás Bence)
- wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx (Emmanuel Grumbach)
- wifi: mac80211: remove misplaced drv_mgd_complete_tx() call (Johannes Berg)
- wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() (Johannes Berg)
- wifi: iwlwifi: don't warn during reprobe (Miri Korenblit)
- wifi: iwlwifi: use correct IMR dump variable (Johannes Berg)
- mptcp: pm: userspace: flags: clearer msg if no remote addr (Matthieu Baerts)
- wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV (P Praneesh)
- xfrm: prevent high SEQ input in non-ESN mode (Leon Romanovsky)
- drm/v3d: Add clock handling (Stefan Wahren)
- net/mlx5e: reduce the max log mpwrq sz for ECPF and reps (William Tu)
- net/mlx5e: reduce rep rxq depth to 256 for ECPF (William Tu)
- net/mlx5e: set the tx_queue_len for pfifo_fast (William Tu)
- net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB (Alexei Lazar)
- net/mlx5: XDP, Enable TX side XDP multi-buffer support (Alexei Lazar)
- scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr() (Chaohai Chen)
- drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer() (Alex Deucher)
- drm/amdgpu: enlarge the VBIOS binary size limit (Morris Zhang)
- drm/amdgpu: Use active umc info from discovery (Lijo Lazar)
- drm/amd/display: Populate register address for dentist for dcn401 (Dillon Varone)
- drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It (Austin Zheng)
- drm/amd/display: Increase block_sequence array size (Joshua Aberback) [Orabug: 38095164] {CVE-2025-38080}
- drm/amd/display: Initial psr_version with correct setting (Tom Chung)
- drm/amd/display: Update CR AUX RD interval interpretation (George Shen)
- Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY" (Brandon Syu)
- drm/amd/display: Support multiple options during psr entry. (Martin Tsai)
- drm/amd/pm: Skip P2S load for SMU v13.0.12 (Asad Kamal)
- drm/amdgpu: reset psp-&gt;cmd to NULL after releasing the buffer (Jiang Liu)
- drm/amd/display: Don't try AUX transactions on disconnected link (Ilya Bakoulin)
- drm/amd/display: pass calculated dram_speed_mts to dml2 (Charlene Liu)
- drm/amdgpu: Set snoop bit for SDMA for MI series (Harish Kasiviswanathan)
- drm/amdkfd: fix missing L2 cache info in topology (Eric Huang)
- drm/amdgpu/mes11: fix set_hw_resources_1 calculation (Alex Deucher)
- net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size (Huacai Chen)
- soundwire: cadence_master: set frame shape and divider based on actual clk freq (Bard Liao)
- soundwire: amd: change the soundwire wake enable/disable sequence (Vijendar Mukunda)
- phy: exynos5-usbdrd: fix EDS distribution tuning (gs101) (André Draszik)
- phy: core: don't require set_mode() callback for phy_get_mode() to work (Dmitry Baryshkov)
- phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF (Damon Ding)
- pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down (Claudiu Beznea)
- serial: sh-sci: Update the suspend/resume support (Claudiu Beznea)
- sched: Reduce the default slice to avoid tasks getting an extra tick (Zihan Zhou)
- x86/traps: Cleanup and robustify decode_bug() (Peter Zijlstra)
- x86/ibt: Handle FineIBT in handle_cfi_failure() (Peter Zijlstra)
- drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set (Shuicheng Lin)
- drm/xe/debugfs: fixed the return value of wedged_mode_set (Xin Wang)
- clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate (Krzysztof Kozlowski)
- clk: qcom: ipq5018: allow it to be bulid on arm32 (Karl Chan)
- drm/xe: Fix xe_tile_init_noalloc() error propagation (Lucas De Marchi)
- drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init() (Lucas De Marchi)
- net/mlx4_core: Avoid impossible mlx4_db_alloc() order value (Kees Cook)
- media: v4l: Memset argument to 0 before calling get_mbus_config pad op (Sakari Ailus)
- media: i2c: imx219: Correct the minimum vblanking value (David Plowman)
- kunit: tool: Use qboot on QEMU x86_64 (Brendan Jackman)
- smack: Revert "smackfs: Added check catlen" (Konstantin Andreev)
- smack: recognize ipv4 CIPSO w/o categories (Konstantin Andreev)
- pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map (Valentin Caron)
- ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() (Kuninori Morimoto)
- ASoC: tas2764: Power up/down amp on mute ops (Hector Martin)
- ASoC: tas2764: Mark SW_RESET as volatile (Hector Martin)
- ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG (Hector Martin)
- ASoC: ops: Enforce platform maximum on initial value (Martin Povišer)
- firmware: xilinx: Dont send linux address to get fpga config get status (Siva Durga Prasad Paladugu)
- firmware: arm_ffa: Handle the presence of host partition in the partition info (Sudeep Holla)
- firmware: arm_ffa: Reject higher major version as incompatible (Sudeep Holla)
- net/mlx5: Apply rate-limiting to high temperature warning (Shahar Shitrit)
- net/mlx5: Modify LSB bitmask in temperature event to include only the first bit (Shahar Shitrit)
- media: test-drivers: vivid: don't call schedule in loop (Hans Verkuil)
- irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base (Andrew Jones)
- hrtimers: Replace hrtimer_clock_to_base_table with switch-case (Andy Shevchenko)
- vxlan: Join / leave MC group after remote changes (Petr Machata)
- ACPI: HED: Always initialize before evged (Xiaofei Tan)
- PCI: Fix old_size lower bound in calculate_iosize() too (Ilpo Järvinen)
- eth: mlx4: don't try to complete XDP frames in netpoll (Jakub Kicinski)
- bpf: copy_verifier_state() should copy 'loop_entry' field (Eduard Zingerman) [Orabug: 38095018] {CVE-2025-38060}
- bpf: don't do clean_live_states when state-&gt;loop_entry-&gt;branches &gt; 0 (Eduard Zingerman)
- can: c_can: Use of_property_present() to test existence of DT property (Krzysztof Kozlowski)
- pmdomain: imx: gpcv2: use proper helper for property detection (Ahmad Fatoum)
- RDMA/core: Fix best page size finding when it can cross SG entries (Michael Margolin)
- serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (Alexis Lothoré) [Orabug: 38094901] {CVE-2025-38040}
- drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink (Harry Wentland)
- Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP" (Leo Zeng)
- drm/amd/display: Read LTTPR ALPM caps during link cap retrieval (George Shen)
- drm/amd/display: Fix BT2020 YCbCr limited/full range input (Ilya Bakoulin)
- drm/amd/display: Guard against setting dispclk low when active (Nicholas Kazlauskas)
- drm/amd/display: Add support for disconnected eDP streams (Harry Vanzylldejong)
- drm/amd/pm: Fetch current power limit from PMFW (Lijo Lazar)
- irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector (Anup Patel)
- eeprom: ee1004: Check chip before probing (Eddie James)
- mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs (Chris Morgan)
- i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA) (Frank Li)
- EDAC/ie31200: work around false positive build warning (Arnd Bergmann)
- power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree (Chris Morgan)
- net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [Orabug: 38095024] {CVE-2025-38061}
- wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU (Kuan-Chung Chen)
- wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware (Ping-Ke Shih)
- wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32() (Ping-Ke Shih)
- wifi: rtw89: fw: propagate error code from rtw89_h2c_tx() (Ping-Ke Shih)
- wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU (Bitterblue Smith)
- PCI: epf-mhi: Update device ID for SA8775P (Mrinmay Sarkar)
- clocksource: mips-gic-timer: Enable counter when CPUs start (Paul Burton)
- MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core (Paul Burton)
- genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (Jason Gunthorpe) [Orabug: 38095031] {CVE-2025-38062}
- x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op() (Uros Bizjak)
- drm/amdgpu: remove all KFD fences from the BO on release (Christian König)
- MIPS: Use arch specific syscall name match function (Bibo Mao)
- drm/xe/oa: Ensure that polled read returns latest data (Umesh Nerlige Ramappa)
- net: ipv6: Init tunnel link-netns before registering dev (Xiao Liang)
- crypto: skcipher - Zap type in crypto_alloc_sync_skcipher (Herbert Xu)
- crypto: ahash - Set default reqsize from ahash_alg (Herbert Xu)
- x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh)
- net/mlx5: Change POOL_NEXT_SIZE define value and make it global (Patrisious Haddad)
- scsi: scsi_debug: First fixes for tapes (Kai Mäkisara)
- dm: fix unconditional IO throttle caused by REQ_PREFLUSH (Jinliang Zheng) [Orabug: 38095038] {CVE-2025-38063}
- libbpf: Fix out-of-bound read (Nandakumar Edamana)
- loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize (Christoph Hellwig)
- net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode (Jianbo Liu)
- media: tc358746: improve calculation of the D-PHY timing registers (Matthias Fend)
- media: adv7180: Disable test-pattern control on adv7180 (Niklas Söderlund)
- cpuidle: menu: Avoid discarding useful information (Rafael J. Wysocki)
- vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines (Konstantin Shkolnyy)
- x86/nmi: Add an emergency handler in nmi_desc &amp; use it in nmi_shootdown_cpus() (Waiman Long)
- ASoC: mediatek: mt8188: Add reference for dmic clocks (Nícolas F R A Prado)
- ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile (Nícolas F R A Prado)
- drm/amd/display: Fix mismatch type comparison (Navid Assadian)
- drm/amd/display: fix dcn4x init failed (Charlene Liu)
- drm/amd/display: handle max_downscale_src_width fail check (Yihan Zhu)
- x86/build: Fix broken copy command in genimage.sh when making isoimage (Nir Lichtman)
- Octeontx2-af: RPM: Register driver with PCI subsys IDs (Hariprasad Kelam)
- bpf: Search and add kfuncs in struct_ops prologue and epilogue (Amery Hung)
- soc: ti: k3-socinfo: Do not use syscon helper to build regmap (Andrew Davis)
- wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band (Ramasamy Kaliappan)
- bonding: report duplicate MAC address in all situations (Hangbin Liu)
- net: xgene-v2: remove incorrect ACPI_PTR annotation (Arnd Bergmann)
- net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only (Eric Woudstra)
- leds: pwm-multicolor: Add check for fwnode_property_read_u32 (Yuanjun Gong)
- drm/xe: xe_gen_wa_oob: replace program_invocation_short_name (Daniel Gomez)
- drm/amdkfd: KFD release_work possible circular locking (Philip Yang)
- pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf (Inochi Amaoto)
- selftests/net: have `gro.sh -t` return a correct exit code (Kevin Krakauer)
- net/mlx5: Avoid report two health errors on same syndrome (Moshe Shemesh)
- drm/xe/pf: Create a link between PF and VF devices (K V P Satyanarayana)
- drm/xe/vf: Retry sending MMIO request to GUC on timeout error (K V P Satyanarayana)
- firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar) [Orabug: 38094925] {CVE-2025-38043}
- PCI: brcmstb: Add a softdep to MIP MSI-X driver (Stanimir Varbanov)
- PCI: brcmstb: Expand inbound window size up to 64GB (Stanimir Varbanov)
- wifi: ath12k: Report proper tx completion status to mac80211 (Vinith Kumar R)
- soc: apple: rtkit: Implement OSLog buffers properly (Hector Martin)
- soc: apple: rtkit: Use high prio work queue (Janne Grunau)
- perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters (Rob Herring)
- fpga: altera-cvp: Increase credit timeout (Kuhanh Murugasen Krishnan)
- drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence (AngeloGioacchino Del Regno)
- ARM: at91: pm: fix at91_suspend_finish for ZQ calibration (Li Bin)
- hwmon: (gpio-fan) Add missing mutex locks (Alexander Stein)
- x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Breno Leitao)
- clk: imx8mp: inform CCF of maximum frequency of clocks (Ahmad Fatoum)
- media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value (Ricardo Ribalda)
- media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map (Ricardo Ribalda)
- ublk: complete command synchronously on error (Caleb Sander)
- block: mark bounce buffering as incompatible with integrity (Christoph Hellwig)
- drm/rockchip: vop2: Add uv swap for cluster window (Andy Yan)
- ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). (Kuniyuki Iwashima)
- scsi: logging: Fix scsi_logging_level bounds (Nicolas Bouchinet)
- ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7 (Maciej S. Szmigiero)
- perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (Saket Kumar Bhaskar)
- net: pktgen: fix mpls maximum labels list parsing (Peter Seiderer)
- media: imx335: Set vblank immediately (Paul Elder)
- iommufd: Disallow allocating nested parent domain with fault ID (Yi Liu)
- ublk: enforce ublks_max only for unprivileged devices (Uday Shankar)
- dpll: Add an assertion to check freq_supported_num (Jiasheng Jiang)
- net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104 (Andrei Botila)
- net: ethernet: ti: cpsw_new: populate netdev of_node (Alexander Sverdlin)
- rcu: Fix get_state_synchronize_rcu_full() GP-start detection (Paul E. McKenney)
- pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" (Artur Weber)
- media: cx231xx: set device_caps for 417 (Hans Verkuil) [Orabug: 38094934] {CVE-2025-38044}
- perf/core: Clean up perf_try_init_event() (Peter Zijlstra)
- drm/amd/display: Request HW cursor on DCN3.2 with SubVP (Aric Cyr)
- drm/amd/display: Fix p-state type when p-state is unsupported (Dillon Varone)
- drm/amd/display: Fix DMUB reset sequence for DCN401 (Dillon Varone)
- drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination (George Shen)
- drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35 (Nicholas Kazlauskas)
- drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c (Victor Lu)
- remoteproc: qcom_wcnss: Handle platforms with only single power domain (Matti Lehtimäki)
- blk-throttle: don't take carryover for prioritized processing of metadata (Ming Lei)
- net: phylink: use pl-&gt;link_interface in phylink_expects_phy() (Choong Yong Liang)
- drm/gem: Test for imported GEM buffers with helper (Thomas Zimmermann)
- orangefs: Do not truncate file size (Matthew Wilcox) [Orabug: 38095056] {CVE-2025-38065}
- soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables (AngeloGioacchino Del Regno)
- dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [Orabug: 38095063] {CVE-2025-38066}
- usb: xhci: set page size to the xHCI-supported size (Niklas Neronin)
- media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() (Markus Elfring)
- ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 (Svyatoslav Ryhel)
- soc: samsung: include linux/array_size.h where needed (Arnd Bergmann)
- drm/xe: Retry BO allocation (Matthew Brost)
- drm/xe: Nuke VM's mapping upon close (Matthew Brost)
- ieee802154: ca8210: Use proper setters and getters for bitwise types (Andy Shevchenko)
- rtc: ds1307: stop disabling alarms on probe (Alexandre Belloni)
- tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() (Eric Dumazet)
- ALSA: seq: Improve data consistency at polling (Takashi Iwai)
- powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 (Andreas Schwab)
- arm64: tegra: Resize aperture for the IGX PCIe C5 slot (Jonathan Hunter)
- arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator (Diogo Ivo)
- drm/amdgpu: Fix missing drain retry fault the last entry (Emily Deng)
- drm/amdkfd: Set per-process flags only once cik/vi (Harish Kasiviswanathan)
- drm/amdkfd: Set per-process flags only once for gfx9/10/11/12 (Harish Kasiviswanathan)
- crypto: mxs-dcp - Only set OTP_KEY bit for OTP key (Sven Schwermer)
- crypto: lzo - Fix compression buffer overrun (Herbert Xu) [Orabug: 38095079] {CVE-2025-38068}
- misc: pci_endpoint_test: Give disabled BARs a distinct error code (Niklas Cassel)
- PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops (Christian Bruel) [Orabug: 38095087] {CVE-2025-38069}
- watchdog: aspeed: Update bootstatus handling (Chin-Ting Kuo)
- cpufreq: tegra186: Share policy per cluster (Aaron Kling)
- iommu/amd/pgtbl_v2: Improve error handling (Vasant Hegde)
- coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t (Levi Yun)
- badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable &lt; 0 (Coly Li)
- ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup() (Alexey Klimov)
- auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" (Andy Shevchenko)
- gfs2: Check for empty queue in run_queue (Andreas Gruenbacher)
- drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch (Leon Huang)
- drm/amd/display: not abort link train when bw is low (Peichen Huang)
- drm/amd/display: calculate the remain segments for all pipes (Zhikai Zhai)
- drm/amd/display: remove minimum Dispclk and apply oem panel timing. (Charlene Liu)
- ipv6: save dontfrag in cork (Willem de Bruijn)
- wifi: cfg80211: allow IR in 20 MHz configurations (Anjaneyulu)
- wifi: mac80211_hwsim: Fix MLD address translation (Ilan Peer)
- wifi: mac80211: fix warning on disconnect during failed ML reconf (Johannes Berg)
- wifi: iwlwifi: fix the ECKV UEFI variable name (Emmanuel Grumbach)
- wifi: iwlwifi: mark Br device not integrated (Johannes Berg)
- wifi: iwlwifi: fix debug actions order (Johannes Berg) [Orabug: 38094942] {CVE-2025-38045}
- wifi: iwlwifi: w/a FW SMPS mode selection (Daniel Gabay)
- wifi: iwlwifi: don't warn when if there is a FW error (Miri Korenblit)
- printk: Check CON_SUSPEND when unblanking a console (Marcos Paulo de Souza)
- iommu: Keep dev-&gt;iommu state consistent (Robin Murphy)
- hwmon: (dell-smm) Increment the number of fans (Kurt Borja)
- wifi: iwlwifi: mvm: fix setting the TK when associated (Avraham Stern)
- usb: xhci: Don't change the status of stalled TDs on failed Stop EP (Michał Pecio)
- mmc: sdhci: Disable SD card clock before changing parameters (Erick Shepherd)
- mmc: dw_mmc: add exynos7870 DW MMC support (Kaustabh Chakraborty)
- arm64/mm: Check PUD_TYPE_TABLE in pud_bad() (Ryan Roberts)
- arm64/mm: Check pmd_table() in pmd_trans_huge() (Ryan Roberts)
- phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set (Andy Yan)
- PNP: Expand length of fixup id string (Kees Cook)
- netfilter: conntrack: Bound nf_conntrack sysctl writes (Nicolas Bouchinet)
- wifi: rtw89: set force HE TB mode when connecting to 11ax AP (Dian-Syuan Yang)
- timer_list: Don't use %pK through printk() (Thomas Weißschuh)
- net: hsr: Fix PRP duplicate detection (Jaakko Karrenpalo)
- net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe (Jonas Karlman)
- posix-timers: Ensure that timer initialization is fully visible (Thomas Gleixner)
- posix-timers: Add cond_resched() to posix_timer_add() search loop (Eric Dumazet)
- RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() (Maher Sanalla)
- ext4: do not convert the unwritten extents if data writeback fails (Baokun Li)
- ext4: reject the 'data_err=abort' option in nojournal mode (Baokun Li)
- clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490 (Taniya Das)
- ASoC: sun4i-codec: support hp-det-gpios property (Ryan Walklin)
- drm/amdgpu: Update SRIOV video codec caps (David Rosca)
- drm/amdgpu/gfx11: don't read registers in mqd init (Alex Deucher)
- drm/amdgpu/gfx12: don't read registers in mqd init (Alex Deucher)
- mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check (Shree Ramamoorthy)
- pinctrl-tegra: Restore SFSEL bit when freeing pins (Prathamesh Shete)
- xen: Add support for XenServer 6.1 platform device (Frediano Ziglio)
- net/smc: use the correct ndev to find pnetid by pnetid table (Guangguan Wang)
- dm: restrict dm device size to 2^63-512 bytes (Mikulas Patocka)
- crypto: octeontx2 - suppress auth failure screaming due to negative tests (Shashank Gupta)
- kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf (Masahiro Yamada)
- kbuild: fix argument parsing in scripts/config (Seyediman Seyedarab)
- bpf: Allow pre-ordering for bpf cgroup progs (Yonghong Song)
- ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect (Nícolas F R A Prado)
- ASoC: pcm6240: Drop bogus code handling IRQ as GPIO (Linus Walleij)
- spi: spi-mux: Fix coverity issue, unchecked return value (Sergio Perez Gonzalez)
- erofs: initialize decompression early (Gao Xiang)
- thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer (Mika Westerberg)
- objtool: Fix error handling inconsistencies in check() (Josh Poimboeuf)
- rtc: rv3032: fix EERD location (Alexandre Belloni)
- tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() (Ilpo Järvinen)
- jbd2: do not try to recover wiped journal (Jan Kara)
- PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off() (Frank Li)
- bpf: Return prog btf_id without capable check (Mykyta Yatsenko)
- vfio/pci: Handle INTx IRQ_NOTCONNECTED (Alex Williamson)
- scsi: st: ERASE does not change tape location (Kai Mäkisara)
- scsi: st: Tighten the page format heuristics with MODE SELECT (Kai Mäkisara)
- hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure (Al Viro)
- ext4: reorder capability check last (Christian Göttsche)
- riscv: Call secondary mmu notifier when flushing the tlb (Alexandre Ghiti)
- bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set (Shantiprasad Shettar)
- wifi: mwifiex: Fix HT40 bandwidth issue. (Jeff Chen)
- um: Update min_low_pfn to match changes in uml_reserved (Tiwei Bie)
- um: Store full CSGSFS and SS register from mcontext (Benjamin Berg)
- clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug (Nick Hu)
- dlm: make tcp still work in multi-link env (Heming Zhao)
- s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste() (Heiko Carstens)
- i3c: master: svc: Fix missing STOP for master request (Stanley Chu)
- drm/amdgpu: adjust drm_firmware_drivers_only() handling (Alex Deucher)
- drm/amd/display: Guard against setting dispclk low for dcn31x (Jing Zhou)
- drm/amdgpu: release xcp_mgr on exit (Flora Cui)
- blk-cgroup: improve policy registration error handling (Chen Linxuan)
- btrfs: send: return -ENAMETOOLONG when attempting a path that is too long (Filipe Manana)
- btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work() (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to async workers (Filipe Manana)
- btrfs: run btrfs_error_commit_super() early (Qu Wenruo)
- btrfs: avoid linker error in btrfs_find_create_tree_block() (Mark Harmstone)
- btrfs: make btrfs_discard_workfn() block_group ref explicit (Boris Burkov)
- i2c: pxa: fix call balance of i2c-&gt;clk handling routines (Vitalii Mordan)
- i2c: qup: Vote for interconnect bandwidth to DRAM (Stephan Gerhold)
- x86/mm: Check return value from memblock_phys_alloc_range() (Philip Redkin) [Orabug: 38095101] {CVE-2025-38071}
- x86/microcode: Update the Intel processor flag scan check (Sohil Mehta)
- x86/smpboot: Fix INIT delay assignment for extended Intel Families (Sohil Mehta)
- x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP (Ingo Molnar)
- x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers (Thomas Huth)
- wifi: mt76: mt7925: fix fails to enter low power mode in suspend state (Quan Zhou)
- wifi: mt76: mt7925: load the appropriate CLC data based on hardware type (Ming Yen Hsieh)
- wifi: mt76: mt7996: revise TXS size (Benjamin Lin)
- wifi: mt76: mt7996: fix SER reset trigger on WED reset (Rex Lu)
- wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 (Felix Fietkau)
- cgroup/rstat: avoid disabling irqs for O(num_cpu) (Eric Dumazet)
- drm/amdgpu: Skip pcie_replay_count sysfs creation for VF (Victor Skvortsov)
- mmc: host: Wait for Vdd to settle on card power off (Erick Shepherd)
- staging: vchiq_arm: Create keep-alive thread during probe (Stefan Wahren)
- pidfs: improve multi-threaded exec and premature thread-group leader exit polling (Christian Brauner)
- libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [Orabug: 38095109] {CVE-2025-38072}
- ext4: on a remount, only log the ro or r/w state when it has changed (Nicolas Bretz)
- xen/pci: Do not register devices with segments &gt;= 0x10000 (Roger Pau Monné)
- PCI: vmd: Disable MSI remapping bypass under Xen (Roger Pau Monné)
- drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12 (Jonathan Kim)
- drm/amdgpu/discovery: check ip_discovery fw file available (Flora Cui)
- pNFS/flexfiles: Report ENETDOWN as a connection error (Trond Myklebust)
- tools/build: Don't pass test log files to linker (Ian Rogers)
- r8169: disable RTL8126 ZRX-DC timeout (Chunhao Lin)
- PCI: dwc: ep: Ensure proper iteration over outbound map windows (Frank Li)
- objtool: Properly disable uaccess validation (Josh Poimboeuf)
- lockdep: Fix wait context check on softirq for PREEMPT_RT (Ryo Takakura)
- dql: Fix dql-&gt;limit value when reset. (Jing Su)
- Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken (Pedro Nishiyama)
- Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal (Sean Wang)
- thermal/drivers/qoriq: Power down TMU on system suspend (Alice Guo)
- thermal/drivers/mediatek/lvts: Start sensor interrupts disabled (Nícolas F R A Prado)
- net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus (Hans-Frieder Vogt)
- net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards (Hans-Frieder Vogt)
- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (Daniel Hsu)
- ASoC: codecs: wsa883x: Correct VI sense channel mask (Krzysztof Kozlowski)
- ASoC: codecs: wsa884x: Correct VI sense channel mask (Krzysztof Kozlowski)
- spi-rockchip: Fix register out of bounds access (Luis de Arquer) [Orabug: 38095173] {CVE-2025-38081}
- SUNRPC: rpcbind should never reset the port to the value '0' (Trond Myklebust)
- SUNRPC: rpc_clnt_set_transport() must not change the autobind setting (Trond Myklebust)
- NFSv4: Treat ENETUNREACH errors as fatal for state recovery (Trond Myklebust)
- cifs: Fix establishing NetBIOS session for SMB2+ connection (Pali Rohár)
- cifs: add validation check for the fields in smb_aces (Namjae Jeon)
- cifs: Set default Netbios RFC1001 server name to hostname in UNC (Pali Rohár)
- fbdev: core: tileblit: Implement missing margin clearing for tileblit (Zsolt Kajtar)
- fbcon: Use correct erase colour for clearing in fbcon (Zsolt Kajtar)
- fbdev: fsl-diu-fb: add missing device_remove_file() (Shixiong Ou)
- riscv: Allow NOMMU kernels to access all of RAM (Samuel Holland)
- mailbox: use error ret code of of_parse_phandle_with_args() (Tudor Ambarus)
- mailbox: pcc: Use acpi_os_ioremap() instead of ioremap() (Sudeep Holla)
- tpm: Convert warn to dbg in tpm2_start_auth_session() (Jonathan Mcdowell)
- ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list (Diogo Ivo)
- tracing: Mark binary printing functions with __printf() attribute (Andy Shevchenko)
- iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability (Yi Liu)
- arm64: Add support for HIP09 Spectre-BHB mitigation (Jinqian Yang)
- SUNRPC: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFS: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Trond Myklebust)
- io_uring/msg: initialise msg request opcode (Pavel Begunkov)
- exfat: call bh_read in get_block only when necessary (Sungjong Seo)
- fuse: Return EPERM rather than ENOSYS from link() (Matt Johnston)
- smb: client: Store original IO parameters and prevent zero IO sizes (Zhaolong Wang)
- cifs: Fix negotiate retry functionality (Pali Rohár)
- cifs: Fix querying and creating MF symlinks over SMB1 (Pali Rohár)
- cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES (Pali Rohár)
- s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log (Tony Krowiak)
- x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li) [Orabug: 38094951] {CVE-2025-38047}
- kconfig: merge_config: use an empty file as initfile (Daniel Gomez)
- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (Haoran Jiang)
- bpf: fix possible endless loop in BPF map iteration (Brandon Kammerdiener)
- io_uring: don't duplicate flushing in io_req_post_cqe (Pavel Begunkov)
- block: fix race between set_blocksize and read paths (Darrick J. Wong) [Orabug: 38095117] {CVE-2025-38073}
- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (Ihor Solodrai)
- drm/amdgpu: Allow P2P access through XGMI (Felix Kuehling)
- drm/amd/display: Enable urgent latency adjustment on DCN35 (Nicholas Susanto)
- fs/ext4: use sleeping version of sb_find_get_block() (Davidlohr Bueso)
- fs/jbd2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/ocfs2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: introduce sleeping flavors for pagecache lookups (Davidlohr Bueso)
- fs/buffer: split locking for pagecache lookups (Davidlohr Bueso)
- ima: process_measurement() needlessly takes inode_lock() on MAY_READ (Frederick Lawler)
- dma-mapping: Fix warning reported for missing prototype (Balbir Singh)
- net: enetc: refactor bulk flipping of RX buffers to separate function (Vladimir Oltean)
- vhost_task: fix vhost_task_create() documentation (Stefano Garzarella)
- cgroup: Fix compilation issue due to cgroup_mutex not being exported (Gao Xu)
- dma-mapping: avoid potential unused data compilation warning (Marek Szyprowski)
- mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type (Hans de Goede)
- intel_th: avoid using deprecated page-&gt;mapping, index fields (Lorenzo Stoakes)
- dma/mapping.c: dev_dbg support for dma_addressing_limited (Balbir Singh)
- virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han) [Orabug: 38094958] {CVE-2025-38048}
- scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices (Manish Pandey)
- scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [Orabug: 38095134] {CVE-2025-38075}
- nvmem: qfprom: switch to 4-byte aligned reads (Dmitry Baryshkov)
- nvmem: core: update raw_len if the bit reading is required (Dmitry Baryshkov)
- nvmem: core: verify cell's raw_len (Dmitry Baryshkov)
- nvmem: core: fix bit offsets of more than one byte (Dmitry Baryshkov)
- nvmem: rockchip-otp: add rk3576 variant data (Heiko Stuebner)
- nvmem: rockchip-otp: Move read-offset into variant-data (Heiko Stuebner)
- cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist (Pengyu Luo)
- phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Move IRQ request in probe (Claudiu Beznea)
- i2c: designware: Fix an error handling path in i2c_dw_pci_probe() (Christophe Jaillet)
- i2c: designware: Use temporary variable for struct device (Andy Shevchenko)
- drm/amd/display: Defer BW-optimization-blocked DRR adjustments (John Olender)
- drm/amd/display: Correct timing_adjust_pending flag setting. (Zhongwei)
- drm/amd/display: Do not enable replay when vtotal update is pending. (Sung-Huai Wang)
- drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401 (Dillon Varone)
- LTS version: v6.12.30 (Jack Vogel)
- drm/amdgpu: fix pm notifier handling (Alex Deucher)
- phy: tegra: xusb: remove a stray unlock (Dan Carpenter)
- usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977018] {CVE-2025-37967}
- drm/tiny: panel-mipi-dbi: Use drm_client_setup_with_fourcc() (Fabio Estevam)
- drm/panel-mipi-dbi: Run DRM default client setup (Thomas Zimmermann)
- drm/fbdev-dma: Support struct drm_driver.fbdev_probe (Thomas Zimmermann)
- Bluetooth: btnxpuart: Fix kernel panic during FW release (Neeraj Sanjay Kale) [Orabug: 37844459] {CVE-2025-22102}
- iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977026] {CVE-2025-37968}
- accel/ivpu: Fix fw log printing (Jacek Lawrynowicz)
- accel/ivpu: Refactor functions in ivpu_fw_log.c (Jacek Lawrynowicz)
- accel/ivpu: Reset fw log on cold boot (Tomasz Rusinowicz)
- accel/ivpu: Rename ivpu_log_level to fw_log_level (Jacek Lawrynowicz)
- mm/page_alloc: fix race condition in unaccepted memory handling (Kirill A. Shutemov) [Orabug: 38094767] {CVE-2025-38008}
- drm/xe/gsc: do not flush the GSC worker from the reset path (Daniele Ceraolo Spurio)
- CIFS: New mount option for cifs.upcall namespace resolution (Ritvik Budhiraja)
- dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (Shuai Xue) [Orabug: 38094790] {CVE-2025-38014}
- dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094793] {CVE-2025-38015}
- dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call (Shuai Xue)
- dmaengine: idxd: Add missing cleanups in cleanup internals (Shuai Xue)
- dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs (Shuai Xue)
- dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy (Yemike Abhilash Chandra)
- dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094756] {CVE-2025-38005}
- mm: userfaultfd: correct dirty flags set for both present and swap pte (Barry Song)
- net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
- ring-buffer: Fix persistent buffer when commit page is the reader page (Steven Rostedt)
- wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094770] {CVE-2025-38009}
- tpm: Mask TPM RC in tpm2_start_auth_session() (Jarkko Sakkinen)
- spi: tegra114: Use value to check for invalid delays (Aaron Kling)
- smb: client: fix memory leak during error handling for POSIX mkdir (Jethro Donaldson)
- scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer (Steve Siwinski)
- phy: renesas: rcar-gen3-usb2: Set timing registers only once (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind (Claudiu Beznea)
- phy: Fix error handling in tegra_xusb_port_init (Ma Ke)
- phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking (Wayne Chang) [Orabug: 38094777] {CVE-2025-38010}
- tracing: samples: Initialize trace_array_printk() with the correct function (Steven Rostedt)
- ftrace: Fix preemption accounting for stacktrace filter command (Donglin Peng)
- ftrace: Fix preemption accounting for stacktrace trigger command (Donglin Peng)
- kbuild: Disable -Wdefault-const-init-unsafe (Nathan Chancellor)
- Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer() (Michael Kelley)
- Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (Michael Kelley)
- arm64: dts: rockchip: Remove overdrive-mode OPPs from RK3588J SoC dtsi (Dragan Simic)
- arm64: dts: amlogic: dreambox: fix missing clkc_audio node (Christian Hewitt)
- hv_netvsc: Remove rmsg_pgcnt (Michael Kelley)
- hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (Michael Kelley)
- hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (Michael Kelley)
- dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi)
- ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera (Nicolas Chauvet)
- ALSA: usb-audio: Add sample rate quirk for Audioengine D1 (Christian Heusel)
- ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() (Xu Wang)
- ACPI: PPTT: Fix processor subtable walk (Jeremy Linton)
- gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
- MAINTAINERS: Update Alexey Makhalov's email address (Alexey Makhalov)
- drm/amd/display: Avoid flooding unnecessary info messages (Wayne Lin)
- drm/amd/display: Correct the reply value when AUX write incomplete (Wayne Lin)
- drm/amdgpu: csa unmap use uninterruptible lock (Philip Yang) [Orabug: 38094779] {CVE-2025-38011}
- drm/amdgpu: fix incorrect MALL size for GFX1151 (Tim Huang)
- Revert "drm/amd/display: Hardware cursor changes color when switched to software cursor" (Melissa Wen)
- btrfs: add back warning for mount option commit values exceeding 300 (Kyoji Ogasawara)
- btrfs: fix folio leak in submit_one_async_extent() (Boris Burkov)
- btrfs: fix discard worker infinite loop after disabling discard (Filipe Manana)
- LoongArch: uprobes: Remove redundant code about resume_era (Tiezhu Yang)
- LoongArch: uprobes: Remove user_{en,dis}able_single_step() (Tiezhu Yang)
- LoongArch: Fix MAX_REG_OFFSET calculation (Huacai Chen)
- LoongArch: Save and restore CSR.CNTC for hibernation (Huacai Chen)
- LoongArch: Move __arch_cpu_idle() to .cpuidle.text section (Huacai Chen)
- LoongArch: Prevent cond_resched() occurring within kernel-fpu (Tianyang Zhang)
- HID: bpf: abort dispatch if device destroyed (Rongrong) [Orabug: 38094796] {CVE-2025-38016}
- udf: Make sure i_lenExtents is uptodate on inode eviction (Jan Kara)
- sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator (Tejun Heo) [Orabug: 38094786] {CVE-2025-38012}
- dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" (Nathan Lynch)
- NFSv4/pnfs: Reset the layout state after a layoutreturn (Trond Myklebust)
- tsnep: fix timestamping with a stacked DSA driver (Gerhard Engleder)
- net/tls: fix kernel panic when alloc_page failed (Pengtao He) [Orabug: 38094802] {CVE-2025-38018}
- mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (Ido Schimmel) [Orabug: 38094804] {CVE-2025-38019}
- wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request (Kees Cook) [Orabug: 38094788] {CVE-2025-38013}
- octeontx2-pf: Do not reallocate all ntuple filters (Subbaraya Sundeep)
- octeontx2-af: Fix CGX Receive counters (Hariprasad Kelam)
- net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability (Bc-Bocun Chen)
- octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy (Subbaraya Sundeep)
- netlink: specs: tc: all actions are indexed arrays (Jakub Kicinski)
- netlink: specs: tc: fix a couple of attribute names (Jakub Kicinski)
- drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value (Umesh Nerlige Ramappa)
- regulator: max20086: fix invalid memory access (Cosmin Tanislav) [Orabug: 38094833] {CVE-2025-38027}
- qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() (Abdun Nihaal)
- net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094808] {CVE-2025-38020}
- vsock/test: Fix occasional failure in SIOCOUTQ tests (Konstantin Shkolnyy)
- net: dsa: b53: prevent standalone from trying to forward to other ports (Jonas Gorski)
- ALSA: sh: SND_AICA should depend on SH_DMA_API (Geert Uytterhoeven)
- nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (Keith Busch)
- nvme-pci: make nvme_pci_npages_prp() __always_inline (Kees Cook)
- net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING (Vladimir Oltean)
- net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe)
- ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info (Takashi Iwai)
- ALSA: seq: Fix delivery of UMP events to group ports (Takashi Iwai)
- net: mctp: Ensure keys maintain only one ref to corresponding dev (Andrew Jeffery)
- tests/ncdevmem: Fix double-free of queue array (Cosmin Ratiu)
- selftests: ncdevmem: Switch to AF_INET6 (Stanislav Fomichev)
- selftests: ncdevmem: Make client_ip optional (Stanislav Fomichev)
- selftests: ncdevmem: Unify error handling (Stanislav Fomichev)
- selftests: ncdevmem: Separate out dmabuf provider (Stanislav Fomichev)
- selftests: ncdevmem: Redirect all non-payload output to stderr (Stanislav Fomichev)
- net: mctp: Don't access ifa_index when missing (Matt Johnston)
- mctp: no longer rely on net-&gt;dev_index_head[] (Eric Dumazet)
- tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing (Hangbin Liu)
- net_sched: Flush gso_skb list too during -&gt;change() (Cong Wang) [Orabug: 37998128] {CVE-2025-37992}
- Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags (Luiz Augusto von Dentz)
- RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Zhu Yanjun) [Orabug: 38094813] {CVE-2025-38022}
- spi: loopback-test: Do not split 1024-byte hexdumps (Geert Uytterhoeven)
- nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094818] {CVE-2025-38023}
- HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 38094764] {CVE-2025-38007}
- HID: thrustmaster: fix memory leak in thrustmaster_interrupts() (Qasim Ijaz)
- RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094827] {CVE-2025-38024}
- virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx (Koichiro Den)
- virtio_ring: add a func argument 'recycle_done' to virtqueue_reset() (Koichiro Den)
- iio: chemical: sps30: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7768-1: Fix insufficient alignment of timestamp. (Jonathan Cameron)
- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
- xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
- Revert "drm/amd: Stop evicting resources on APUs in suspend" (Alex Deucher)
- drm/amd: Add Suspend/Hibernate notification callback support (Mario Limonciello)
- iio: pressure: mprls0025pa: use aligned_s64 for timestamp (David Lechner)
- iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7266: Fix potential timestamp alignment issue. (Jonathan Cameron)
- KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (Sean Christopherson)
- KVM: Add member to struct kvm_gfn_range to indicate private/shared (Isaku Yamahata)
- uio_hv_generic: Fix sysfs creation path for ring buffer (Naman Jain)
- tpm: tis: Double the timeout B to 4s (Michal Suchanek)
- tracing: probes: Fix a possible race in trace_probe_log APIs (Masami Hiramatsu)
- cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks (Waiman Long)
- arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout (Himanshu Bhavani)
- platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection (Hans de Goede)
- platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL) (Runhua He)
- binfmt_elf: Move brk for static PIE even if ASLR disabled (Kees Cook)
- riscv: dts: sophgo: fix DMA data-width configuration for CV18xx (Ze Huang)
- drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies (Mario Limonciello)
- drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC Policies (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list to always include security.* xattrs (Stephen Smalley)
- arm64: dts: rockchip: Assign RT5616 MCLK rate on rk3588-friendlyelec-cm3588 (Tom Vincent)
- LTS version: v6.12.29 (Jack Vogel)
- arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977004] {CVE-2025-37963}
- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976926] {CVE-2025-37948}
- arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
- arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
- arm64: insn: Add support for encoding DSB (James Morse)
- mm: page_alloc: speed up fallbacks in rmqueue_bulk() (Johannes Weiner)
- mm: page_alloc: don't steal single pages from biggest buddy (Johannes Weiner)
- Bluetooth: btmtk: Remove the resetting step before downloading the fw (Hao Qin)
- Bluetooth: btmtk: Remove resetting mt7921 before downloading the fw (Hao Qin)
- io_uring: always arm linked timeouts prior to issue (Jens Axboe)
- rust: clean Rust 1.88.0's `clippy::uninlined_format_args` lint (Miguel Ojeda)
- rust: allow Rust 1.87.0's `clippy::ptr_eq` lint (Miguel Ojeda)
- Revert "um: work around sched_yield not yielding in time-travel mode" (Christian Lamparter)
- do_umount(): add missing barrier before refcount checks in sync case (Al Viro)
- io_uring/sqpoll: Increase task_work submission batch size (Gabriel Krisman Bertazi)
- drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs (Tejas Upadhyay)
- drm/xe/tests/mocs: Update xe_force_wake_get() return handling (Himal Prasad Ghimiray)
- riscv: misaligned: enable IRQs while handling misaligned accesses (Clément Léger)
- riscv: misaligned: factorize trap handling (Clément Léger)
- nvme: unblock ctrl state transition for firmware update (Daniel Wagner)
- drm/panel: simple: Update timings for AUO G101EVN010 (Kevin Baker)
- loop: Add sanity check for read/write_iter (Lizhi Xu)
- loop: factor out a loop_assign_backing_file helper (Christoph Hellwig)
- loop: refactor queue limits updates (Christoph Hellwig)
- loop: Fix ABBA locking race (Ogawa Hirofumi)
- loop: Simplify discard granularity calc (John Garry)
- loop: Use bdev limit helpers for configuring discard (John Garry)
- riscv: misaligned: Add handling for ZCB instructions (Nylon Chen)
- MIPS: Fix MAX_REG_OFFSET (Thorsten Blum)
- iio: adc: dln2: Use aligned_s64 for timestamp (Jonathan Cameron)
- iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64 (Jonathan Cameron)
- types: Complement the aligned types with signed 64-bit one (Andy Shevchenko)
- iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer. (Jonathan Cameron)
- iio: accel: adxl367: fix setting odr for activity time update (Lothar Rubusch)
- usb: usbtmc: Fix erroneous generic_read ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous wait_srq ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous get_stb ioctl error returns (Dave Penkler)
- USB: usbtmc: use interruptible sleep in usbtmc_read (Oliver Neukum)
- usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015126] {CVE-2025-37994}
- usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition (Rd Babiera)
- usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs (Lukasz Czechowski)
- usb: host: tegra: Prevent host controller crash when OTG port is used (Jim Lin)
- usb: gadget: Use get_status callback to set remote wakeup capability (Prashanth K)
- usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN (Wayne Chang)
- usb: gadget: f_ecm: Add get_status callback (Prashanth K)
- usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version (Pawel Laszczak)
- usb: cdnsp: Fix issue with resuming from L1 (Pawel Laszczak)
- usb: dwc3: gadget: Make gadget_wakeup asynchronous (Prashanth K)
- x86/microcode: Consolidate the loader enablement checking (Borislav Petkov)
- module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015131] {CVE-2025-37995}
- memblock: Accept allocated memory before use in memblock_double_array() (Tom Lendacky) [Orabug: 37976994] {CVE-2025-37960}
- clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() (Sebastian Andrzej Siewior)
- arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong idmap generation (Levi Yun)
- accel/ivpu: Increase state dump msg timeout (Jacek Lawrynowicz)
- xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976934] {CVE-2025-37949}
- xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it (John Ernberg)
- smb: client: Avoid race in open_cached_dir with lease breaks (Paul Aurich) [Orabug: 37976959] {CVE-2025-37954}
- usb: uhci-platform: Make the clock really optional (Alexey Charkov)
- drm/amdgpu/hdp7: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amd/display: Copy AUX read reply data whenever length &gt; 0 (Wayne Lin)
- drm/amd/display: Fix wrong handling for AUX_DEFER case (Wayne Lin)
- drm/amd/display: Remove incorrect checking in dmub aux handler (Wayne Lin)
- drm/amd/display: Fix the checking condition in dmub aux handling (Wayne Lin)
- drm/amd/display: more liberal vmin/vmax update for freesync (Aurabindo Pillai)
- drm/amd/display: Fix invalid context error in dml helper (Roman Li) [Orabug: 37977185] {CVE-2025-37965}
- drm/amdgpu/vcn: using separate VCN1_AON_SOC offset (Ruijing Dong)
- drm/xe: Add page queue multiplier (Matthew Brost)
- drm/v3d: Add job to pending list if the reset was skipped (Maíra Canal) [Orabug: 37976942] {CVE-2025-37951}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug: 37977031] {CVE-2025-37969}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977037] {CVE-2025-37970}
- iio: imu: inv_mpu6050: align buffer for timestamp (David Lechner)
- iio: adis16201: Correct inclinometer channel resolution (Gabriel)
- iio: adc: rockchip: Fix clock initialization sequence (Simon Xue)
- iio: adc: ad7606: fix serial register access (Angelo Dureghello)
- io_uring: ensure deferred completions are flushed for multishot (Jens Axboe)
- drm/amd/display: Shift DMUB AUX reply command if necessary (Wayne Lin)
- KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (Mikhail Lobanov) [Orabug: 37976977] {CVE-2025-37957}
- selftests/mm: fix a build failure on powerpc (Nysal Jan K.A.)
- selftests/mm: compaction_test: support platform with huge mount of memory (Feng Tang)
- mm/userfaultfd: fix uninitialized output field for -EAGAIN race (Peter Xu)
- mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976982] {CVE-2025-37958}
- mm: fix folio_pte_batch() on XEN PV (Petr Vaněk)
- x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (Dave Hansen) [Orabug: 37977013] {CVE-2025-37964}
- staging: axis-fifo: Correct handling of tx_fifo_depth for size validation (Gabriel)
- staging: axis-fifo: Remove hardware resets for user errors (Gabriel)
- staging: bcm2835-camera: Initialise dev in v4l2_dev (Dave Stevenson) [Orabug: 37977042] {CVE-2025-37971}
- staging: iio: adc: ad7816: Correct conditional logic for store mode (Gabriel)
- rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.87.0 (Miguel Ojeda)
- rust: clean Rust 1.88.0's `unnecessary_transmutes` lint (Miguel Ojeda)
- Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 (Aditya Garg)
- Input: synaptics - enable SMBus for HP Elitebook 850 G1 (Dmitry Torokhov)
- Input: synaptics - enable InterTouch on Dell Precision M3800 (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30L-G (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30-D (Manuel Fombuena)
- Input: xpad - fix two controller table values (Vicki Pfau)
- Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller (Lode Willems)
- Input: xpad - fix Share button on Xbox One controllers (Vicki Pfau)
- Input: mtk-pmic-keys - fix possible null pointer dereference (Gary Bisson) [Orabug: 37977044] {CVE-2025-37972}
- Input: cyttsp5 - fix power control issue on wakeup (Mikael Gonella-Bolduc)
- Input: cyttsp5 - ensure minimum reset pulse width (Hugo Villeneuve)
- virtio-net: fix total qstat values (Jakub Kicinski)
- net: export a helper for adding up queue stats (Jakub Kicinski)
- fbnic: Do not allow mailbox to toggle to ready outside fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Pull fbnic_fw_xmit_cap_msg use out of interrupt context (Alexander Duyck)
- fbnic: Improve responsiveness of fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Actually flush_tx instead of stalling out (Alexander Duyck)
- fbnic: Gate AXI read/write enabling on FW mailbox (Alexander Duyck)
- fbnic: Fix initialization of mailbox descriptor rings (Alexander Duyck)
- net: dsa: b53: do not set learning and unicast/multicast on up (Jonas Gorski)
- net: dsa: b53: fix learning on VLAN unaware bridges (Jonas Gorski)
- net: dsa: b53: fix toggling vlan_filtering (Jonas Gorski)
- net: dsa: b53: do not program vlans when vlan filtering is off (Jonas Gorski)
- net: dsa: b53: do not allow to configure VLAN 0 (Jonas Gorski)
- net: dsa: b53: always rejoin default untagged VLAN on bridge leave (Jonas Gorski)
- net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave (Jonas Gorski)
- net: dsa: b53: fix flushing old pvid VLAN on pvid change (Jonas Gorski)
- net: dsa: b53: fix clearing PVID of a port (Jonas Gorski)
- net: dsa: b53: keep CPU port always tagged again (Jonas Gorski)
- net: dsa: b53: allow leaky reserved multicast (Jonas Gorski)
- bpf: Scrub packet on bpf_redirect_peer (Paul Chaignon) [Orabug: 37976990] {CVE-2025-37959}
- netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015141] {CVE-2025-37997}
- ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [Orabug: 37976996] {CVE-2025-37961}
- erofs: ensure the extra temporary copy is valid for shortened bvecs (Gao Xiang)
- ice: use DSN instead of PCI BDF for ice_adapter index (Przemek Kitszel)
- ice: Initial support for E825C hardware in ice_adapter (Sergey Temerkhanov)
- wifi: mac80211: fix the type of status_code for negotiated TID to Link Mapping (Michael-Cy Lee)
- can: gw: fix RCU/BH usage in cgw_create_job() (Oliver Hartkopp)
- can: mcp251xfd: fix TDC setting for low data bit rates (Kelsey Maes)
- can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe (Antonios Salios) [Orabug: 38015123] {CVE-2025-37993}
- net: ethernet: mtk_eth_soc: do not reset PSE when setting FE (Frank Wunderlich)
- net: ethernet: mtk_eth_soc: reset all TX queues on DMA free (Daniel Golle)
- gre: Fix again IPv6 link-local address generation. (Guillaume Nault)
- virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (Jakub Kicinski) [Orabug: 37976969] {CVE-2025-37955}
- virtio_net: xsk: bind/unbind xsk for tx (Xuan Zhuo)
- sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 37977176] {CVE-2025-37953}
- s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
- ksmbd: fix memory leak in parse_lease_state() (Zhaolong Wang) [Orabug: 37977180] {CVE-2025-37962}
- openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015148] {CVE-2025-37998}
- ksmbd: Fix UAF in __close_file_table_ids (Sean Heelan) [Orabug: 37976951] {CVE-2025-37952}
- ksmbd: prevent out-of-bounds stream writes by validating *pos (Norbert Szetei) [Orabug: 37976923] {CVE-2025-37947}
- ksmbd: prevent rename with empty string (Namjae Jeon) [Orabug: 37976972] {CVE-2025-37956}
- can: rockchip_canfd: rkcanfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Niklas Schnelle) [Orabug: 37976920] {CVE-2025-37946}
- vfio/pci: Align huge faults to order (Alex Williamson)
- wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation (Veerendranath Jakkam) [Orabug: 37977046] {CVE-2025-37973}
- s390/pci: Fix missing check for zpci_create_device() error return (Niklas Schnelle) [Orabug: 37977050] {CVE-2025-37974}
- can: mcan: m_can_class_unregister(): fix order of unregistration calls (Marc Kleine-Budde)
- firmware: arm_scmi: Fix timeout checks on polling path (Cristian Marussi)
- arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2 (Wojciech Dubowik)
- Revert "btrfs: canonicalize the device path before adding it" (Qu Wenruo)
- fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (Max Kellermann) [Orabug: 38015155] {CVE-2025-37999}
- dm: add missing unlock on in dm_keyslot_evict() (Dan Carpenter)
- mm/vmscan: wake up flushers conditionally to avoid cgroup OOM (Zeng Jingxiang) [Orabug: 37480932]
- dmaengine: idxd: Narrow the restriction on BATCH to ver. 1 only (Vinicius Costa Gomes) [Orabug: 37801355]
- uek-rpm: build the fwctl mlx5 driver on UEK (Qing Huang) [Orabug: 37810636]
- fwctl: Adapt upstream code for UEK8 (Mikhael Goikhman) [Orabug: 37810636]
- mlx5: Create an auxiliary device for fwctl_mlx5 (Saeed Mahameed) [Orabug: 37810636]
- fwctl/mlx5: Support for communicating with mlx5 fw (Saeed Mahameed) [Orabug: 37810636]
- fwctl: Add documentation (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware (Jason Gunthorpe) [Orabug: 37810636]
- taint: Add TAINT_FWCTL (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_INFO to return basic information about the device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Basic ioctl dispatch for the character device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Add basic structure for a class subsystem with a cdev (Jason Gunthorpe) [Orabug: 37810636]
- Revert "fwctl: Add basic structure for a class subsystem with a cdev" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Basic ioctl dispatch for the character device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_INFO to return basic information about the device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Support for communicating with mlx5 fw" (Qing Huang) [Orabug: 37810636]
- Revert "mlx5: Create an auxiliary device for fwctl_mlx5" (Qing Huang) [Orabug: 37810636]
- Revert "taint: Add TAINT_FWCTL" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Adapt code for UEK-NEXT" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Add INTERNAL_DEV_RES uctx capability" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Allow up to 4k devices" (Qing Huang) [Orabug: 37810636]
- Revert "uek-rpm: build the fwctl mlx5 driver on UEK" (Qing Huang) [Orabug: 37810636]
- dmaengine: idxd: Change err messages to dbg (Jack Vogel) [Orabug: 37841831]
- PCI: Add PCI_VDEVICE_SUB helper macro (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbevf: Add support for Intel(R) E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Enable link management in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Clean up the E610 link management related code (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add ixgbe_x540 multiple header inclusion protection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for EEPROM dump in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for NVM handling in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add link management support for E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 device capabilities detection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 FW Admin Command Interface (Piotr Kwapulinski) [Orabug: 37889575]
- uek-rpm: Move the gve kernel module from extra to kernel-uek-core (Samasth Norway Ananda) [Orabug: 37940897]
- uek-rpm/config-aarch64: Enable BT_HCIUART_BCM for RPi Bluetooth (Vijay Kumar) [Orabug: 37961540]
- platform/mellanox: mlxbf-pmc: Support additional PMC blocks (Shravan Kumar Ramani) [Orabug: 37964051]
- mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug: 37964051,38037120] {CVE-2025-37866}
- mlxbf-bootctl: Support sysfs entries for RTC battery status (Xiangrong Li) [Orabug: 37964051]
- platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37964051]
- uek-rpm: CONFIG_PTP_1588_CLOCK_OCP enable for OCI (Vijayendra Suman) [Orabug: 37966384]
- x86/its: Fix build errors when CONFIG_MODULES=n (Eric Biggers) [Orabug: 37970148]
- x86/its: Use dynamic thunks for indirect branches (Peter Zijlstra) [Orabug: 37970148]
- x86/ibt: Keep IBT disabled during alternative patching (Pawan Gupta) [Orabug: 37970148]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 37989268]
- amd_hsmp: Increase the SMU timeout to 500ms (Vijay Kumar) [Orabug: 38000074]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge)  [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang)  [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming)  [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams)  [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson)  [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley)  [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson)  [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson)  [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang)  [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang)  [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang)  [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang)  [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang)  [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang)  [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie)  [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie)  [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen)  [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen)  [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda)  [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda)  [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.1.el10uek]" date="1750939200">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.2.el10uek]" date="1752148800">- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38178286]  {CVE-2025-38089}
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38162790]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38175263]
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)  [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)  [Orabug: 38175246]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.3.el10uek]" date="1752494400">- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38171405]</changelog>
</package>
<package pkgid="8d6f027fbf00cb51a122ad3d16a129f90ad0d208" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="102.36.5.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge) [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang) [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming) [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams) [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson) [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley) [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson) [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson) [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang) [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang) [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang) [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang) [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang) [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang) [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie) [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie) [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen) [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen) [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda) [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda) [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger)  [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan)  [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan)  [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin)
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota)
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu)
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng)
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann)
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo)
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov)
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu)
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi)
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung)
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei Zhang)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Wentao Liang)
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold)
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-ji Chen)
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu)
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett)
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana)
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li (Intel))
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells)
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara)
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko)
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima)
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai)
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee)
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima)
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet)
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer)
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai)
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin)
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (SeongJae Park)
- smb: client: remove 	 from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima)
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski)
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev)
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo)
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski)
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang)
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin.Cao)
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng)
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke)
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun)
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (FUJITA Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin KaFai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu)
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra)
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher)
- smb: client: fix first command failure during re-negotiation (zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich)
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet)
- net: atm: add lec_mutex (Eric Dumazet)
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima)
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg)
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev)
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski)
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu)
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima)
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima)
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov)
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo)
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh AP)
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon)
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka)
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders)
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sá)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott)
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath SM)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal)
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn)
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis)
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam)
- Input: sparcspkr - avoid unannotated fall-through (WangYuli)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar)
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima)
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rong Zhang)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon)
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li (Intel))
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski)
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet)
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath SM)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin)
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov)
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang)
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton)
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes)
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook)
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Wentao Liang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij)
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo)
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner)
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu)
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh AP)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso)
- f2fs: fix to bail out in get_new_segment() (Chao Yu)
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski)
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R)
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin)
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao)
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S)
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (gldrk)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han)
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han)
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn)
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos)
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang)
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang)
- regulator: max14577: Add error check for max14577_read_reg() (Wentao Liang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel Shahrouzi)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann)
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz)
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin)
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Wentao Liang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Wentao Liang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams)
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'ichiro Kawasaki)
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park)
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (GONG Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu)
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim)
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski)
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han)
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu)
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim)
- f2fs: fix to do sanity check on ino and xnid (Chao Yu)
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter)
- ext4: only dirty folios when data journaling regular files (Brian Foster)
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo)
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis)
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko)
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin)
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeff Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar)
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski)
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian)
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev)
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis)
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li)
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Wentao Liang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis)
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park)
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann)
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng)
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (NeilBrown)
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh)
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter)
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Wentao Liang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Wentao Liang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Wentao Liang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F. R. A. Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li (Intel))
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner)
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov)
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt)
- 9p: Add a migrate_folio method (Matthew Wilcox (Oracle))
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (RD Babiera)
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby (SUSE))
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Wupeng Ma)
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard)
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov)
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge)
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox (Oracle))
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox (Oracle))
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig)
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang)
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana)
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski)
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet)
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet)
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet)
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin)
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz)
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski)
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski)
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj)
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui)
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani (IBM))
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet)
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang)
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park)
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz)
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav)
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold)
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro)
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki NAGAO)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski)
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel)
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal)
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari)
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song)
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng)
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré)
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré)
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak)
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas)
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen)
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Yeoreum Yun)
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz)
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (WangYuli)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang)
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin)
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar)
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin)
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang)
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng)
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe JAILLET)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe JAILLET)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski)
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin)
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov)
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin)
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov)
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin)
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei)
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Wentao Liang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher)
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F. R. A. Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo)
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima)
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam)
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur)
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang)
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (KaFai Wan)
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein)
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich)
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen)
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook)
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li RongQing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin)
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin)
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný)
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (ping.gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen)
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu)
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu)
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev)
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring (Arm))
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen)
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko)
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin)
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (YiFei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad)
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso)
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang)
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan)
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma)
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen XIN)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen XIN)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu)
- f2fs: prevent the current section from being selected as a victim during GC (yohan.joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter)
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu)
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen)
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen)
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang)
- xen/x86: fix initial memory balloon target (Roger Pau Monne)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon)
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A. R. Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin)
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe JAILLET)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao)
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao)
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland)
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown)
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han)
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian)
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo)
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot)
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong)
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu)
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F. R. A. Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu (Google))
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby (SUSE))
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait)
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper)
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli)  [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha)  [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137447]  {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky)  [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli)  [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly)  [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry)  [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson)  [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson)  [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry)  [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry)  [Orabug: 38026089]
- xfs: update atomic write limits (John Garry)  [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry)  [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry)  [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry)  [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry)  [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry)  [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong)  [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong)  [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry)  [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong)  [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry)  [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong)  [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong)  [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig)  [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig)  [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry)  [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry)  [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry)  [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry)  [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry)  [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry)  [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry)  [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry)  [Orabug: 38026089]
- dm-table: atomic writes support (John Garry)  [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry)  [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry)  [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry)  [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry)  [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry)  [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry)  [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry)  [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry)  [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry)  [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry)  [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry)  [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry)  [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry)  [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry)  [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry)  [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry)  [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen)  [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge)  [Orabug: 38137957]
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge)  [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge)  [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna)  [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju)  [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.1.el10uek]" date="1754481600">- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann)  [Orabug: 38217337]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.2.el10uek]" date="1755086400">- iommu/vt-d: Fix misplaced domain_attached assignment (Ban ZuoXiang)  [Orabug: 38294635]</changelog>
</package>
<package pkgid="39444afad72fe1bcea59be886e1409f569e381ef" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger) [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo) [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan) [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan) [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
</package>
<package pkgid="9b34a65982fa6c5bde29d0f8aadec2ebf5e135ff" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]  
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
</package>
<package pkgid="6d6bc4fbfb60b85698e70b942cd309b8f17dc6df" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560} 
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500} 
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566} 
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571} 
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618} 
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
</package>
<package pkgid="111ad2469695a4668eb381680e670d3cc79e0b4a" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560}
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500}
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566}
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571}
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618}
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.4.el10uek]" date="1759492800">- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton)  [Orabug: 38500610]  {CVE-2025-38724} 
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38500621]  {CVE-2025-39698} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38500629]  {CVE-2025-39881} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38500632]  {CVE-2025-39866}</changelog>
</package>
<package pkgid="a8c39336a915c9662cf2da20bc73b5fbff29e1fa" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="104.43.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
</package>
<package pkgid="30bb13de2e183a7ce8285109a7e8e90ccd2fee59" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="104.43.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.3.el10uek]" date="1761220800">- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38572958]  {CVE-2025-39698} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38572953]  {CVE-2025-39866} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38572951]  {CVE-2025-3988} 
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon)  [Orabug: 38572950]  {CVE-2025-39718} 
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38572948]  {CVE-2025-39964} 
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)  [Orabug: 38572947]  {CVE-2025-39963} 
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)  [Orabug: 38572946]  {CVE-2025-39965} 
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski)  [Orabug: 38572944]  {CVE-2025-39946} 
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)  [Orabug: 38572943]  {CVE-2025-39977} 
- i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38572941]  {CVE-2025-39973}</changelog>
</package>
<package pkgid="b235b543f8c42791c3eca257fe32a5e1ce42c42a" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="105.51.5.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)
- media: rc: fix races with imon_disconnect() (Larshin Sergey)
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik)
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)
- i40e: add validation for ring_len param (Lukasz Czapnik)
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.1.el10uek]" date="1764590400">- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu)  [Orabug: 38712788]  {CVE-2025-40019} 
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712786]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="56df51c206b5044cb7ff51c358fc3e31f655f442" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="105.51.5.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]  
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]  
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]  
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]  
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]  
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]  
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]  
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]  
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]  
- LTS version: v6.12.51 (Jack Vogel)   
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)   
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)   
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)   
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)   
- media: rc: fix races with imon_disconnect() (Larshin Sergey)   
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)   
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)   
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)   
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)   
- crypto: sha256 - fix crash at kexec (Breno Leitao)   
- LTS version v6.12.50 (Jack Vogel)   
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)   
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)   
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)   
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)   
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)   
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)   
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)   
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)   
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)   
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)   
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)   
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)   
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)   
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)   
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))   
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)   
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)   
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)   
- i40e: add max boundary check for VF filters (Lukasz Czapnik)   
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)   
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)   
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)   
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)   
- i40e: add validation for ring_len param (Lukasz Czapnik)   
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)   
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)   
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)   
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)   
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)   
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)   
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)   
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)   
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)   
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)   
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)   
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)   
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)   
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)   
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)   
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)   
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)   
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)   
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)   
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)   
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)   
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)   
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)   
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)   
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)   
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)   
- wifi: virt_wifi: Fix page fault on connect (James Guan)   
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)   
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)   
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)   
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)   
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)   
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)   
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)   
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)   
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)   
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)   
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)   
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)   
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)   
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)   
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)   
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)   
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)   
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)   
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)   
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)   
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)   
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)   
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)   
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)   
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)   
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
</package>
<package pkgid="1a6f2dc26b71fa1141a0ceb0f6c9908c44fabb9b" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="106.55.4.1.el10uek"/>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="b0cad7ea2d132f34f8bf7488ba8213b463586cd3" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="106.55.4.2.el10uek"/>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.2.el10uek]" date="1766145600">- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)   {CVE-2025-40271} 
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="8d84b32e7969b81d26cbf6e456d2bbed7be3170d" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="6fe2b6b3d289dfeb7092e8a361d73b37a6c486d3" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
</package>
<package pkgid="ca7c104b500230803882108551f9be72d9f8b328" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.4.el10uek]" date="1770292800">- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet)  [Orabug: 38932996]  {CVE-2025-40257} 
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38932973]  {CVE-2025-40149} 
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet)  [Orabug: 38932955]  {CVE-2025-40258} 
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38932939]</changelog>
</package>
<package pkgid="faede7216c806d69ff50550cc5e24775806e4b61" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="108.64.6.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge) [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp) [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal) [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.62.1.el10uek]" date="1765886400">- uek-rpm: Allow disabling kabichk at command line (Yifei Liu) [Orabug: 38733049]
- Revert "xfrm: Use xdo.dev instead of xdo.real_dev" (Jack Vogel) [Orabug: 38718730]
- Revert "net/mlx5: Fix IPsec cleanup over MPV device" (Jack Vogel) [Orabug: 38718730]
- LTS version: v6.12.62 (Jack Vogel)
- bus: mhi: host: pci_generic: Add Telit FN990B40 modem support (Daniele Palmas)
- bus: mhi: host: pci_generic: Add Telit FN920C04 modem support (Daniele Palmas)
- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (Navaneeth K)
- staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (Navaneeth K)
- staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (Navaneeth K)
- comedi: check device's attached status in compat ioctls (Nikita Zhandarovich)
- comedi: multiq3: sanitize config options in multiq3_attach() (Nikita Zhandarovich)
- comedi: c6xdigio: Fix invalid PNP driver unregistration (Ian Abbott)
- wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (Zenm Chen)
- wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1 (Zenm Chen)
- samples: work around glibc redefining some of our defines wrong (Linus Torvalds)
- LoongArch: Mask all interrupts during kexec/kdump (Huacai Chen)
- HID: elecom: Add support for ELECOM M-XT3URBK (018F) (Naoki Ueki)
- platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (Antheas Kapenekakis)
- platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (Antheas Kapenekakis)
- platform/x86: huawei-wmi: add keys for HONOR models (Ston Jia)
- HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (April Grimoire)
- platform/x86: acer-wmi: Ignore backlight event (Armin Wolf)
- pinctrl: qcom: msm: Fix deadlock in pinmux configuration (Praveen Talari)
- nvme: fix admin request_queue lifetime (Keith Busch) [Orabug: 38773611] {CVE-2025-68265}
- HID: hid-input: Extend Elan ignore battery quirk to USB (Mario Limonciello)
- bfs: Reconstruct file type when loading from disk (Tetsuo Handa)
- ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (Lushih Hsieh)
- drm/amdkfd: Fix GPU mappings for APU after prefetch (Harish Kasiviswanathan)
- smb: fix invalid username check in smb3_fs_context_parse_param() (Yiqi Sun)
- Bluetooth: btrtl: Avoid loading the config file on security chips (Max Chou)
- drm/vmwgfx: Use kref in vmw_bo_dirty (Ian Forbes)
- spi: imx: keep dma request disabled before dma transfer setup (Robin Gong)
- spi: xilinx: increase number of retries before declaring stall (Alvaro Gamez Machado)
- ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() (Song Liu)
- USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- serial: add support of CPCI cards (Magne Bruno)
- USB: serial: ftdi_sio: match on interface number for jtag (Johan Hovold)
- USB: serial: option: move Telit 0x10c7 composition in the right place (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FE910C04 new compositions (Fabio Porcedda)
- USB: serial: option: add Foxconn T99W760 (Slark Xiao)
- KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (Omar Sandoval) [Orabug: 38773578] {CVE-2025-68259}
- comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (Nikita Zhandarovich)
- ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (Alexey Nepomnyashih) [Orabug: 38773586] {CVE-2025-68261}
- locking/spinlock/debug: Fix data-race in do_raw_write_lock (Alexander Sverdlin)
- ksmbd: ipc: fix use-after-free in ipc_msg_send_request (Qianchang Zhao)
- ext4: refresh inline data size before write operations (Deepanshu Kartikey) [Orabug: 38773602] {CVE-2025-68264}
- jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (Ye Bin) [Orabug: 38792632] {CVE-2025-68337}
- Documentation: process: Also mention Sasha Levin as stable tree maintainer (Bagas Sanjaya)
- xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca)
- xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)
- Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca)
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca) [Orabug: 38730491,38854317] {CVE-2025-40215}
- LTS version: v6.12.61 (Jack Vogel)
- spi: spi-nxp-fspi: Check return value of devm_mutex_init() (Thomas Weißschuh)
- drm/i915/dp: Initialize the source OUI write timestamp always (Imre Deak)
- Revert "ACPI: Suppress misleading SPCR console message when SPCR table is absent" (Punit Agrawal)
- wifi: ath12k: correctly handle mcast packets for clients (Sarika Sharma)
- net: dsa: microchip: Free previously initialized ports on init failures (Bastien Curutchet)
- net: dsa: microchip: Do not execute PTP driver code for unsupported switches (Tristram Ha)
- drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (Thomas Zimmermann) [Orabug: 38773709] {CVE-2025-68296}
- net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() (Bastien Curutchet)
- KVM: SVM: Fix redundant updates of LBR MSR intercepts (Yosry Ahmed)
- KVM: nSVM: Fix and simplify LBR virtualization handling with nested (Yosry Ahmed)
- KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() (Yosry Ahmed)
- KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts() (Yosry Ahmed)
- mm/huge_memory: fix NULL pointer deference when splitting folio (Wei Yang) [Orabug: 38773700] {CVE-2025-68293}
- usb: gadget: udc: fix use-after-free in usb_gadget_state_work (Jimmy Hu) [Orabug: 38773635] {CVE-2025-68282}
- usb: udc: Add trace event for usb_gadget_set_state (Kuen-Han Tsai)
- can: rcar_canfd: Fix CAN-FD mode as default (Biju Das)
- usb: typec: ucsi: psy: Set max current to zero when disconnected (Jameson Thies)
- nfsd: Replace clamp_t in nfsd4_get_drc_mem() (Neil Brown)
- staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann)
- libceph: replace BUG_ON with bounds check for map-&gt;max_osd (Ziming Zhang) [Orabug: 38773641] {CVE-2025-68283}
- libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773648] {CVE-2025-68284}
- libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773654] {CVE-2025-68285}
- net: dsa: microchip: Don't free uninitialized ksz_irq (Bastien Curutchet)
- net: dsa: microchip: ptp: Fix checks on irq_find_mapping() (Bastien Curutchet)
- net: dsa: microchip: common: Fix checks on irq_find_mapping() (Bastien Curutchet)
- drm/amd/display: Don't change brightness for disabled connectors (Mario Limonciello)
- drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773661] {CVE-2025-68286}
- drm/amd/amdgpu: reserve vm invalidation engine for uni_mes (Michael Chen)
- drm: sti: fix device leaks at component probe (Johan Hovold)
- USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang)
- USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov)
- xhci: dbgtty: fix device unregister (Łukasz Bartosik)
- xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman)
- xhci: fix stale flag preventig URBs after link state error is cleared (Mathias Nyman)
- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar)
- usb: dwc3: pci: Sort out the Intel device IDs (Krogerus Heikki)
- usb: dwc3: pci: add support for the Intel Nova Lake -S (Krogerus Heikki)
- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792592] {CVE-2025-68331}
- usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762728] {CVE-2025-40345}
- USB: storage: Remove subclass and protocol overrides from Novatek quirk (Alan Stern)
- usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773676] {CVE-2018-1000204,CVE-2025-68288}
- usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea)
- usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai)
- usb: cdns3: Fix double resource release in cdns3_pci_probe (Miaoqian Lin)
- most: usb: fix double free on late probe failure (Johan Hovold)
- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin)
- mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). (Kuniyuki Iwashima)
- mptcp: clear scheduled subflows on retransmit (Paolo Abeni)
- mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level (Jisheng Zhang)
- mm/memfd: fix information leak in hugetlb folios (Deepanshu Kartikey) [Orabug: 38773697] {CVE-2025-68292}
- firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli)
- nvmem: layouts: fix nvmem_layout_bus_uevent (Guan Wentao)
- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin)
- thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski)
- smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773703] {CVE-2025-68295}
- drivers/usb/dwc3: fix PCI parent check (Jamie Iles)
- dm-verity: fix unreliable memory allocation (Mikulas Patocka)
- ceph: fix crash in process_v2_sparse_read() for encrypted directories (Viacheslav Dubeyko) [Orabug: 38773716] {CVE-2025-68297}
- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde)
- can: sja1000: fix max irq loop handling (Thomas Mühlbacher)
- Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref (Douglas Anderson) [Orabug: 38773723] {CVE-2025-68298}
- atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han)
- ARM: dts: nxp: imx6ul: correct SAI3 interrupt line (Maarten Zanders)
- arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity (Xu Yang)
- arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos (Frank Li)
- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (Ivan Zhaldak)
- tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (Deepanshu Kartikey) [Orabug: 38792583] {CVE-2025-68329}
- MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow (Thomas Bogendoerfer)
- MIPS: mm: Prevent a TLB shutdown on initial uniquification (Maciej W. Rozycki)
- iio: adc: rtq6056: Correct the sign bit index (Chiyuan Huang)
- iio: adc: ad7280a: fix ad7280_store_balance_timer() (David Lechner)
- iio: accel: fix ADXL355 startup race condition (Valek Andrej)
- iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792585] {CVE-2025-68330}
- iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling (Olivier Moysan)
- iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet)
- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra)
- iio: humditiy: hdc3020: fix units for thresholds and hysteresis (Dimitri Fedrau)
- iio: humditiy: hdc3020: fix units for temperature and humidity measurement (Dimitri Fedrau)
- iio: buffer: support getting dma channel from the buffer (Nuno Sa)
- iio: buffer-dmaengine: enable .get_dma_dev() (Nuno Sa)
- iio: buffer-dma: support getting the DMA channel (Nuno Sa)
- Revert "perf/x86: Always store regs-&gt;ip in perf_callchain_kernel()" (Jiri Olsa)
- Revert "drm/amd/display: Move setup_stream_attribute" (Alex Deucher)
- spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou)
- spi: nxp-fspi: Propagate fwnode in ACPI case as well (Andy Shevchenko)
- spi: spi-nxp-fspi: Add OCT-DTR mode support (Haibo Chen)
- spi: spi-nxp-fspi: remove the goto in probe (Haibo Chen)
- spi: nxp-fspi: Support per spi-mem operation frequency switches (Miquel Raynal)
- spi: spi-mem: Add a new controller capability (Miquel Raynal)
- spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency (Miquel Raynal)
- spi: spi-mem: Allow specifying the byte order in Octal DTR mode (Tudor Ambarus)
- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (Xu Wang)
- spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA (Francesco Lavra)
- fs/namespace: fix reference leak in grab_requested_mnt_ns (Andrei Vagin) [Orabug: 38773950] {CVE-2025-68300}
- mailbox: pcc: don't zero error register (Jamie Iles)
- mailbox: pcc: Refactor error handling in irq handler into separate function (Sudeep Holla)
- mailbox: mtk-cmdq: Refine DMA address handling for the command buffer (Jason-JH Lin)
- mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang)
- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (Xu Wang)
- iio: st_lsm6dsx: Fixed calibrated timestamp calculation (Mario Tesi)
- net: fec: do not register PPS event for PEROUT (Wei Fang)
- net: fec: do not allow enabling PPS and PEROUT simultaneously (Wei Fang)
- net: fec: do not update PEROUT if it is enabled (Wei Fang)
- net: fec: cancel perout_timer when PEROUT is disabled (Wei Fang)
- net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773728] {CVE-2025-68301}
- eth: fbnic: Fix counter roll-over issue (Mohsin Bashir)
- net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean)
- net: dsa: sja1105: simplify static configuration reload (Russell King)
- net: wwan: mhi: Keep modem name match with Foxconn T99W640 (Slark Xiao)
- drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (Alex Deucher)
- net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev)
- team: Move team device type change at the end of team_port_add (Nikola Z. Ivanov) [Orabug: 38796270] {CVE-2025-68340}
- net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino)
- drm/xe: Fix conversion from clock ticks to milliseconds (Harish Chegondi)
- net: lan966x: Fix the initialization of taprio (Horatiu Vultur)
- net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng)
- platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter)
- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (Daniel Golle)
- veth: reduce XDP no_direct return section to fix race (Jesper Dangaard Brouer) [Orabug: 38796276] {CVE-2025-68341}
- veth: more robust handing of race to avoid txq getting stuck (Jesper Dangaard Brouer)
- veth: prevent NULL pointer dereference in veth_xdp_rcv (Jesper Dangaard Brouer)
- veth: apply qdisc backpressure on full ptr_ring to reduce TX drops (Jesper Dangaard Brouer)
- net: sched: generalize check for no-queue qdisc on TX queue (Jesper Dangaard Brouer)
- Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz)
- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (Edward Adam Davis) [Orabug: 38773949] {CVE-2025-68305}
- Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP (Luiz Augusto von Dentz)
- Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface (Chris Lu) [Orabug: 38773748] {CVE-2025-68306}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data (Marc Kleine-Budde) [Orabug: 38796278] {CVE-2025-68342}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header (Marc Kleine-Budde) [Orabug: 38796285] {CVE-2025-68343}
- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (Marc Kleine-Budde) [Orabug: 38773751] {CVE-2025-68307}
- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [Orabug: 38773759] {CVE-2025-68308}
- LTS version: v6.12.60 (Jack Vogel)
- Revert "gpio: swnode: don't use the swnode's name as the key for GPIO lookup" (Charles Keepax)
- drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched (Fangzhi Zuo)
- drm/amd/display: Insert dccg log for easy debug (Charlene Liu)
- drm/amd/display: disable DPP RCG before DPP CLK enable (Charlene Liu)
- drm/amd/display: avoid reset DTBCLK at clock init (Charlene Liu)
- xfs: fix out of bounds memory read error in symlink repair (Darrick J. Wong) [Orabug: 38730602] {CVE-2025-40246}
- xfs: Replace strncpy with memcpy (Marcelo Moreira)
- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730655] {CVE-2025-40257}
- drm/i915/dp_mst: Disable Panel Replay (Imre Deak)
- maple_tree: fix tracepoint string pointers (Martin Kaiser)
- tty/vt: fix up incorrect backport to stable releases (Jari Ruusu)
- smb: client: fix incomplete backport in cfids_invalidation_worker() (Henrique Carvalho)
- drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (Samuel Zhang) [Orabug: 38773445] {CVE-2025-68230}
- tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun)
- net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
- ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe)
- s390/mm: Fix __ptep_rdp() inline assembly (Heiko Carstens)
- drm/xe: Prevent BIT() overflow when handling invalid prefetch region (Shuicheng Lin)
- Revert "RDMA/irdma: Update Kconfig" (Guan Wentao)
- KVM: arm64: Make all 32bit ID registers fully writable (Marc Zyngier)
- ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai)
- kconfig/nconf: Initialize the default locale at startup (Jakub Horký)
- kconfig/mconf: Initialize the default locale at startup (Jakub Horký)
- net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit)
- blk-crypto: use BLK_STS_INVAL for alignment errors (Carlos Llamas)
- net: tls: Change async resync helpers argument (Shahar Shitrit)
- selftests: net: use BASH for bareudp testing (Po-Hsu Lin)
- x86/microcode/AMD: Limit Entrysign signature checking to known generations (Borislav Petkov)
- scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773425] {CVE-2025-68224}
- cifs: fix typo in enable_gcm_256 module parameter (Steve French)
- bcma: don't register devices disabled in OF (Rafał Miłecki)
- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730610] {CVE-2025-40248}
- cifs: fix memory leak in smb3_fs_context_parse_param error path (Shaurya Rane) [Orabug: 38773403] {CVE-2025-68219}
- LoongArch: Use UAPI types in ptrace UAPI header (Thomas Weißschuh)
- af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic(). (Kuniyuki Iwashima)
- af_unix: Cache state-&gt;msg in unix_stream_read_generic(). (Kuniyuki Iwashima)
- devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (Shay Drory) [Orabug: 38730623] {CVE-2025-40251}
- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (Jared Kangas)
- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (Jared Kangas)
- ice: fix PTP cleanup on driver removal in error path (Grzegorz Nitka) [Orabug: 38773389] {CVE-2025-68215}
- idpf: fix possible vport_config NULL pointer deref in remove (Emil Tantilov) [Orabug: 38773956] {CVE-2025-68213}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730628] {CVE-2025-40252}
- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang)
- selftests: net: lib: Do not overwrite error messages (Ido Schimmel)
- s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
- nvme-multipath: fix lockdep WARN due to partition scan work (Shin'Ichiro Kawasaki) [Orabug: 38773400] {CVE-2025-68218}
- tools: riscv: Fixed misalignment of CSR related definitions (Chen Pei)
- net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730647] {CVE-2025-40254}
- net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() (Pavel Zhigulin)
- net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin)
- drm/tegra: Add call to put_pid() (Prateek Agarwal) [Orabug: 38773463] {CVE-2025-68233}
- mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
- platform/x86: msi-wmi-platform: Fix typo in WMI GUID (Armin Wolf)
- platform/x86: msi-wmi-platform: Only load on MSI devices (Armin Wolf)
- pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() (Xu Wang)
- xfrm: Prevent locally generated packets from direct output in tunnel mode (Jianbo Liu)
- xfrm: Determine inner GSO type from packet inner protocol (Jianbo Liu)
- pinctrl: realtek: Select REGMAP_MMIO for RTD driver (Yu-Chun Lin)
- xfrm: set err and extack on failure to create pcpu SA (Sabrina Dubroca)
- xfrm: drop SA reference in xfrm_state_update if dir doesn't match (Sabrina Dubroca)
- drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 (Ivan Lipski)
- drm/amd/display: Fix pbn to kbps Conversion (Fangzhi Zuo)
- drm/amd/display: Move sleep into each retry for retrieve_link_cap() (Mario Limonciello)
- drm/amd/display: Increase DPCD read retries (Mario Limonciello)
- drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (Yifan Zha)
- drm/amd: Skip power ungate during suspend for VPE (Mario Limonciello)
- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (Robert Mcclinton) [Orabug: 38773418] {CVE-2025-68223}
- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke)
- mptcp: do not fallback when OoO is present (Paolo Abeni)
- mptcp: decouple mptcp fastclose from tcp close (Paolo Abeni)
- mptcp: avoid unneeded subflow-level drops (Paolo Abeni)
- selftests: mptcp: join: userspace: longer timeout (Matthieu Baerts)
- selftests: mptcp: join: endpoints: longer timeout (Matthieu Baerts)
- mptcp: fix premature close in case of fallback (Paolo Abeni)
- mptcp: fix duplicate reset on fastclose (Paolo Abeni)
- mptcp: fix ack generation for fallback msk (Paolo Abeni)
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730658] {CVE-2025-40258}
- LoongArch: Don't panic if no valid cache info for PCI (Huacai Chen)
- dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski)
- MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
- scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773439] {CVE-2025-68229}
- scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730661] {CVE-2025-40259}
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730672] {CVE-2025-40261}
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne)
- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (Nam Cao) [Orabug: 38773467] {CVE-2025-68235}
- mm/mempool: fix poisoning order&gt;0 pages with HIGHMEM (Vlastimil Babka) [Orabug: 38773453] {CVE-2025-68231}
- Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
- Input: imx_sc_key - fix memory corruption on unload (Dan Carpenter)
- Input: goodix - add support for ACPI ID GDIX1003 (Hans de Goede)
- Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730679] {CVE-2025-40263}
- Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" (Diogo Ivo)
- net: dsa: microchip: lan937x: Fix RGMII delay tuning (Oleksij Rempel)
- be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730688] {CVE-2025-40264}
- ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() (Yihang Li)
- smb: client: introduce close_cached_dir_locked() (Henrique Carvalho)
- ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
- mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773434] {CVE-2025-68227}
- mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen)
- exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang)
- shmem: fix tmpfs reconfiguration (remount) when noswap is set (Mike Yuan)
- isofs: check the return value of sb_min_blocksize() in isofs_fill_super (Yongpeng Yang)
- mtdchar: fix integer overflow in read/write ioctls (Dan Carpenter) [Orabug: 38773476] {CVE-2025-68237}
- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara)
- arm64: dts: rockchip: disable HS400 on RK3588 Tiger (Quentin Schulz)
- arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1 (Quentin Schulz)
- arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5 (Mykola Kvach)
- arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2 (Diederik de Haas)
- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
- HID: amd_sfh: Stop sensor before starting (Mario Limonciello)
- timers: Fix NULL function pointer race in timer_shutdown_sync() (Yipeng Zou) [Orabug: 38773387] {CVE-2025-68214}
- KVM: arm64: Check the untrusted offset in FF-A memory share (Sebastian Ene) [Orabug: 38730696] {CVE-2025-40266}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.2.el10uek]" date="1766491200">- LTS version: v6.12.63 (Jack Vogel)
- ASoC: codecs: nau8325: Silence uninitialized variables warnings (Krzysztof Kozlowski)
- ALSA: wavefront: Fix integer overflow in sample size validation (Junrui Luo)
- ALSA: dice: fix buffer overflow in detect_stream_formats() (Junrui Luo)
- usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required (Sven Peter)
- usb: phy: Initialize struct usb_phy list_head (Diogo Ivo)
- usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (Haotien Hsu)
- tcp_metrics: use dst_dev_net_rcu() (Eric Dumazet) [Orabug: 38592188] {CVE-2025-40075}
- net: dst: introduce dst-&gt;dev_rcu (Eric Dumazet)
- net: lan743x: Allocate rings outside ZONE_DMA (Thangaraj Samynathan)
- LoongArch: Add machine_kexec_mask_interrupts() implementation (Huacai Chen)
- ocfs2: fix memory leak in ocfs2_merge_rec_left() (Dmitry Antipov)
- irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (Dan Carpenter)
- scsi: imm: Fix use-after-free bug caused by unfinished delayed work (Duoming Zhou) [Orabug: 38783113] {CVE-2025-68324}
- efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs (Mauro Carvalho Chehab)
- efi/cper: Adjust infopfx size to accept an extra space (Mauro Carvalho Chehab)
- efi/cper: Add a new helper function to print bitmasks (Mauro Carvalho Chehab)
- dm log-writes: Add missing set_freezable() for freezable kthread (Xu Wang)
- dm-raid: fix possible NULL dereference with undefined raid type (Alexey Simakov)
- block: return unsigned int from queue_dma_alignment (Christoph Hellwig)
- block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set-&gt;tag_list_lock (Mohamed Khalfella) [Orabug: 38818209] {CVE-2025-68756}
- ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() (Pangliyuan)
- ALSA: firewire-motu: add bounds check in put_user loop for DSP events (Junrui Luo)
- rtc: gamecube: Check the return value of ioremap() (Xu Wang)
- drm/amdkfd: Use huge page size to check split svm range alignment (Xiaogang Chen)
- ALSA: uapi: Fix typo in asound.h comment (Andres J Rosa)
- docs: hwmon: fix link to g762 devicetree binding (Kathara Sasikumar)
- cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 (David Howells)
- drm/nouveau: refactor deprecated strcpy (Madhur Kumar)
- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (Junrui Luo)
- regulator: fixed: Rely on the core freeing the enable GPIO (Mark Brown)
- drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() (Dan Carpenter)
- nvme-auth: use kvfree() for memory allocated with kvcalloc() (Israel Rukshin)
- block: fix memory leak in __blkdev_issue_zero_pages (Shaurya Rane) [Orabug: 38798772] {CVE-2025-68348}
- block: fix comment for op_is_zone_mgmt() to include RESET_ALL (Shechenglong)
- blk-mq: Abort suspend when wakeup events are pending (Cong Zhang)
- ASoC: ak5558: Disable regulator when error happens (Shengjiu Wang)
- ASoC: ak4458: Disable regulator when error happens (Shengjiu Wang)
- ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (Xu Wang)
- platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (Anton Khirnov)
- fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() (Armin Wolf)
- NFS: Fix inheritance of the block sizes when automounting (Trond Myklebust)
- Expand the type of nfs_fattr-&gt;valid (Trond Myklebust)
- NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (Trond Myklebust) [Orabug: 38818236] {CVE-2025-68764}
- Revert "nfs: ignore SB_RDONLY when mounting nfs" (Trond Myklebust)
- Revert "nfs: clear SB_RDONLY before getting superblock" (Trond Myklebust)
- Revert "nfs: ignore SB_RDONLY when remounting nfs" (Trond Myklebust)
- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (Jonathan Curley) [Orabug: 38798774] {CVE-2025-68349}
- NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state (Trond Myklebust)
- nfs/vfs: discard d_exact_alias() (Neil Brown)
- NFS: Initialise verifiers for visible dentries in nfs_atomic_open() (Trond Myklebust)
- NFS: Initialise verifiers for visible dentries in readdir and lookup (Trond Myklebust)
- fs/nls: Fix utf16 to utf8 conversion (Armin Wolf)
- NFS: Avoid changing nlink when file removes and attribute updates race (Trond Myklebust)
- f2fs: maintain one time GC mode is enabled during whole zoned GC cycle (Daeho Jeong)
- f2fs: add gc_boost_gc_greedy sysfs node (Daeho Jeong)
- f2fs: add gc_boost_gc_multiple sysfs node (Daeho Jeong)
- f2fs: introduce reserved_pin_section sysfs entry (Chao Yu)
- f2fs: sysfs: add encoding_flags entry (Chao Yu)
- f2fs: add carve_out sysfs node (Daeho Jeong)
- f2fs: fix to avoid running out of free segments (Chao Yu)
- f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages (Jaegeuk Kim)
- f2fs: keep POSIX_FADV_NOREUSE ranges (Jaegeuk Kim)
- platform/x86:intel/pmc: Update Arrow Lake telemetry GUID (Xi Pardee)
- sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out (Xupengbo)
- 9p: fix cache/debug options printing in v9fs_show_options (Eric Sandeen)
- fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (Abdun Nihaal)
- pinctrl: single: Fix incorrect type for error return variable (Xu Wang)
- perf hist: In init, ensure mem_info is put on error paths (Ian Rogers)
- perf tools: Fix split kallsyms DSO counting (Namhyung Kim)
- perf tools: Mark split kallsyms DSOs as loaded (Namhyung Kim)
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei) [Orabug: 38783136] {CVE-2025-68325}
- net: dsa: xrs700x: reject unsupported HSR configurations (Vladimir Oltean)
- net: hsr: create an API to get hsr port type (Xiaoliang Yang)
- net: hsr: Create and export hsr_get_port_ndev() (Md Danish Anwar)
- net: hsr: remove synchronize_rcu() from hsr_add_port() (Eric Dumazet)
- net: hsr: remove one synchronize_rcu() from hsr_del_port() (Eric Dumazet)
- clk: keystone: fix compile testing (Johan Hovold)
- md/raid5: fix IO hang when array is broken with IO inflight (Yu Kuai)
- remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs (Alexandru Gagniuc)
- mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (Ivan Stepchenko)
- selftests: bonding: add delay before each xvlan_over_bond connectivity check (Hangbin Liu)
- selftests: bonding: add ipvlan over bond testing (Etienne Champetier)
- net: phy: aquantia: check for NVMEM deferral (Robert Marko)
- vfio/pci: Use RCU for error/request triggers to avoid circular locking (Alex Williamson)
- spi: ch341: fix out-of-bounds memory access in ch341_transfer_one (Tianchu Chen)
- mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (Xu Wang)
- net: stmmac: fix rx limit check in stmmac_rx_zc() (Alexey Kodanev)
- netfilter: nft_connlimit: update the count if add was skipped (Fernando Fernandez Mancera)
- netfilter: nf_conncount: rework API to use sk_buff directly (Fernando Fernandez Mancera)
- netfilter: flowtable: check for maximum number of encapsulations in bridge vlan (Pablo Neira Ayuso)
- Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" (Ilias Stamatis)
- resource: introduce is_type_match() helper and use it (Andy Shevchenko)
- resource: replace open coded resource_intersection() (Andy Shevchenko)
- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (Sparkhuang) [Orabug: 38798786] {CVE-2025-68354}
- ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND (Mikhail Kshevetskiy)
- ASoC: Intel: catpt: Fix error path in hw_params() (Cezary Rojewski)
- vdpa/pds: use %pe for ERR_PTR() in event handler registration (Alok Tiwari)
- vhost: Fix kthread worker cgroup failure handling (Mike Christie)
- vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues (Alok Tiwari)
- virtio: fix virtqueue_set_affinity() docs (Michael S. Tsirkin)
- virtio: fix grammar in virtio_queue_info docs (Michael S. Tsirkin)
- virtio: fix whitespace in virtio_config_ops (Michael S. Tsirkin)
- virtio: fix typo in virtio_device_ready() comment (Michael S. Tsirkin)
- virtio_vdpa: fix misleading return in void function (Alok Tiwari)
- of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node (Guenter Roeck)
- ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation (Yongjian Sun)
- ublk: prevent invalid access with DEBUG (Kevin Brodsky)
- ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (René Rebe)
- hwmon: sy7636a: Fix regulator_enable resource leak on error path (Xu Wang)
- drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (Dan Carpenter)
- greybus: gb-beagleplay: Fix timeout handling in bootloader functions (Xu Wang)
- firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER (Alexandre Courbot)
- ASoC: fsl_xcvr: clear the channel status control memory (Shengjiu Wang)
- gfs2: Prevent recursive memory reclaim (Andreas Gruenbacher) [Orabug: 38798793] {CVE-2025-68356}
- ASoC: nau8325: add missing build config (Jaroslav Kysela)
- ASoC: nau8325: use simple i2c probe function (Jaroslav Kysela)
- drm/panthor: Avoid adding of kernel BOs to extobj list (Akash Goel)
- RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY (Jacob Moroni)
- RDMA/irdma: Fix data race in irdma_free_pble (Krzysztof Czurylo)
- RDMA/irdma: Fix data race in irdma_sc_ccq_arm (Krzysztof Czurylo)
- iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal (Stephan Gerhold)
- backlight: lp855x: Fix lp855x.h kernel-doc warnings (Randy Dunlap)
- backlight: led-bl: Add devlink to supplier LEDs (Luca Ceresoli)
- wifi: ieee80211: correct FILS status codes (Ria Thomas)
- iomap: always run error completions in user context (Christoph Hellwig)
- iomap: factor out a iomap_dio_done helper (Christoph Hellwig)
- um: Don't rename vmap to kernel_vmap (David Gow)
- drm/nouveau: restrict the flush page to a 32-bit address (Timur Tabi)
- PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (Shawn Lin)
- btrfs: fix leaf leak in an error path in btrfs_del_items() (Filipe Manana)
- iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables (Ryan Huang)
- staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (Jianglei Nie)
- firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (Dinh Nguyen)
- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (Zilin Guan)
- ASoC: tas2781: correct the wrong period (Shenghao Ding)
- RDMA/bnxt_re: Pass correct flag for dma mr creation (Selvin Xavier)
- RDMA/bnxt_re: Fix the inline size for GenP7 devices (Selvin Xavier)
- erofs: limit the level of fs stacking for file-backed mounts (Gao Xiang)
- RISC-V: KVM: Fix guest page fault within HLV* instructions (Fangyu Yu)
- crypto: ccree - Correctly handle return of sg_nents_for_len (Xu Wang)
- crypto: starfive - Correctly handle return of sg_nents_for_len (Xu Wang)
- selftests/bpf: Improve reliability of test_perf_branches_no_hw() (Matt Bobrowski)
- selftests/bpf: skip test_perf_branches_hw() on unsupported platforms (Matt Bobrowski)
- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon)
- usb: dwc2: fix hang during suspend if set as peripheral (Jisheng Zhang)
- usb: dwc2: fix hang during shutdown if set as peripheral (Jisheng Zhang)
- usb: dwc2: disable platform lowlevel hw resources during shutdown (Jisheng Zhang)
- usb: chaoskey: fix locking for O_NONBLOCK (Oliver Neukum)
- ima: Handle error code returned by ima_filter_rule_match() (Zhao Yipeng) [Orabug: 38798921] {CVE-2025-68740}
- RAS: Report all ARM processor CPER information to userspace (Jason Tian)
- wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (Seungjin Bae) [Orabug: 38798814] {CVE-2025-68362}
- cpuset: Treat cpusets in attaching as populated (Chen Ridong)
- net: phy: adin1100: Fix software power-down ready condition (Alexander Dahl)
- phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth (Cristian Ciocaltea)
- phy: freescale: Initialize priv-&gt;lock (Xiaolei Wang)
- phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (Christophe Jaillet)
- leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM (Fenglin Wu)
- mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- wifi: mac80211: fix CMAC functions not handling errors (Chien Wong)
- iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb (Aashish Sharma)
- scsi: qla2xxx: Fix improper freeing of purex item (Zilin Guan) [Orabug: 38798928] {CVE-2025-68741}
- pwm: bcm2835: Make sure the channel is enabled after pwm_request() (Uwe Kleine-König)
- perf arm_spe: Fix memset subclass in operation (Leo Yan)
- perf arm-spe: Extend branch operations (Leo Yan)
- ipv6: clear RA flags when adding a static route (Fernando Fernandez Mancera)
- drm/msm/a6xx: Improve MX rail fallback in RPMH vote init (Akhil P Oommen)
- drm/msm/a6xx: Fix the gemnoc workaround (Akhil P Oommen)
- drm/msm/a6xx: Flush LRZ cache before PT switch (Akhil P Oommen)
- drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (Jay Liu)
- fs/ntfs3: Prevent memory leaks in add sub record (Edward Adam Davis)
- fs/ntfs3: out1 also needs to put mi (Edward Adam Davis)
- powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format (Ritesh Harjani)
- powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit (Ritesh Harjani)
- bpf: Fix invalid prog-&gt;stats access when update_effective_progs fails (Pu Lehui) [Orabug: 38798931] {CVE-2025-68742}
- wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (Abdun Nihaal) [Orabug: 38818221] {CVE-2025-68759}
- drm/msm/a2xx: stop over-complaining about the legacy firmware (Dmitry Baryshkov)
- block/blk-throttle: Fix throttle slice time for SSDs (Guenter Roeck)
- NFSD/blocklayout: Fix minlength check in proc_layoutget (Sergey Bashirov)
- tracefs: fix a leak in eventfs_create_events_dir() (Al Viro)
- watchdog: starfive: Fix resource leak in probe error path (Xu Wang)
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (Xu Wang)
- bpf: Check skb-&gt;transport_header is set in bpf_skb_check_mtu (Martin Kafai Lau) [Orabug: 38798820] {CVE-2025-68363}
- selftests/bpf: Fix failure paths in send_signal test (Alexei Starovoitov)
- bpf: Handle return value of ftrace_set_filter_ip in register_fentry (Menglong Dong)
- ps3disk: use memcpy_{from,to}_bvec index (René Rebe)
- drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype (Dmitry Baryshkov)
- crypto: iaa - Fix incorrect return value in save_iaa_wq() (Zilin Guan)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C (Fukaumi Naoki)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A (Fukaumi Naoki)
- arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A (Fukaumi Naoki)
- PCI: keystone: Exit ks_pcie_probe() for invalid mode (Siddharth Vadapalli)
- bpf: Free special fields when update [lru_,]percpu_hash maps (Leon Hwang) [Orabug: 38798936] {CVE-2025-68744}
- leds: netxbig: Fix GPIO descriptor leak in error paths (Xu Wang)
- scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls (Xu Wang)
- ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (Xu Wang)
- ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() (Dmitry Antipov) [Orabug: 38798823] {CVE-2025-68364}
- lib/vsprintf: Check pointer before dereferencing in time_and_date() (Andy Shevchenko)
- clk: renesas: r9a06g032: Fix memory leak in error path (Xu Wang)
- coresight: etm4x: Add context synchronization before enabling trace (Leo Yan)
- coresight: etm4x: Extract the trace unit controlling (Leo Yan)
- coresight: etm4x: Correct polling IDLE bit (Leo Yan)
- coresight: Change device mode to atomic type (Leo Yan)
- nbd: defer config unlock in nbd_genl_connect (Zheng Qixing) [Orabug: 38798832] {CVE-2025-68366}
- wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (Abdun Nihaal)
- macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (Long Li) [Orabug: 38798837] {CVE-2025-68367}
- powerpc/32: Fix unpaired stwcx. on interrupt exit (Christophe Leroy)
- powerpc/kdump: Fix size calculation for hot-removed memory ranges (Sourabh Jain)
- cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs (Gautham R. Shenoy)
- scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() (Bean Huo)
- drm/panthor: Fix potential memleak of vma structure (Akash Goel)
- ntfs3: init run lock for extend inode (Edward Adam Davis)
- ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties (Jihed Chaibi)
- RDMA/rtrs: server: Fix error handling in get_or_create_srv (Ma Ke)
- dt-bindings: PCI: amlogic: Fix the register name of the DBI region (Manivannan Sadhasivam)
- scsi: smartpqi: Fix device resources accessed after device removal (Mike Mcgowen) [Orabug: 38798847] {CVE-2025-68371}
- scsi: stex: Fix reboot_notifier leak in probe error path (Xu Wang)
- nbd: defer config put in recv_work (Zheng Qixing) [Orabug: 38798850] {CVE-2025-68372}
- md: fix rcu protection in md_wakeup_thread (Yun Zhou) [Orabug: 38798857] {CVE-2025-68374}
- regulator: core: disable supply if enabling main regulator fails (Gabor Juhos)
- perf/x86/intel: Correct large PEBS flag check (Dapeng Mi)
- ext4: correct the checking of quota files before moving extents (Zhang Yi)
- mfd: da9055: Fix missing regmap_del_irq_chip() in error path (Xu Wang)
- locktorture: Fix memory leak in param_set_cpumask() (Wang Liang)
- efi/libstub: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- x86/boot: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels (Yegor Yefremov)
- libbpf: Fix parsing of multi-split BTF (Alan Maguire)
- spi: tegra210-quad: Fix timeout handling (Vishwaroop A) [Orabug: 38798943] {CVE-2025-68746}
- drm/panthor: Fix UAF on kernel BO VA nodes (Boris Brezillon)
- drm/panthor: Fix race with suspend during unplug (Ketil Johnsen)
- drm/panthor: Fix UAF race between device unplug and FW event processing (Ketil Johnsen)
- drm/panthor: Fix group_free_queue() for partially initialized queues (Boris Brezillon)
- drm/panthor: Handle errors returned by drm_sched_entity_init() (Boris Brezillon)
- fs/9p: Don't open remote file with APPEND mode when writeback cache is used (Tingmao Wang)
- scsi: target: Do not write NUL characters into ASCII configfs output (Bart Van Assche)
- power: supply: apm_power: only unset own apm_get_power_status (Ahelenia Ziemiańska)
- power: supply: wm831x: Check wm831x_set_bits() return value (Ivan Abramov)
- power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (Murad Masimov)
- power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (Ivan Abramov)
- power: supply: max17040: Check iio_read_channel_processed() return code (Ivan Abramov)
- power: supply: cw2015: Check devm_delayed_work_autocancel() return code (Ivan Abramov)
- power: supply: rt5033_charger: Fix device node reference leaks (Xu Wang)
- perf record: skip synthesize event when open evsel failed (Shuai Xue)
- perf lock contention: Load kernel map before lookup (Namhyung Kim)
- drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() (Geert Uytterhoeven)
- interconnect: debugfs: Fix incorrect error handling for NULL path (Kuan-Wei Chiu)
- arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller (Dmitry Baryshkov)
- interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS (Dmitry Baryshkov)
- wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() (Abdun Nihaal)
- i3c: master: svc: Prevent incomplete IBI transaction (Stanley Chu)
- i3c: fix refcount inconsistency in i3c_master_register (Frank Li)
- pinctrl: stm32: fix hwspinlock resource leak in probe function (Xu Wang)
- soc: qcom: smem: fix hwspinlock resource leak in probe error paths (Xu Wang)
- tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set (Benjamin Berg)
- x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() (Tengda Wu)
- task_work: Fix NMI race condition (Peter Zijlstra)
- perf/x86/intel/cstate: Remove PC3 support from LunarLake (Zhang Rui)
- bpf: Fix stackmap overflow check in __bpf_get_stackid() (Arnaud Lecomte) [Orabug: 38798864] {CVE-2025-68378}
- bpf: Refactor stack map trace depth calculation into helper function (Arnaud Lecomte)
- perf: Remove get_perf_callchain() init_nr argument (Josh Poimboeuf)
- mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (Xu Wang)
- mtd: nand: relax ECC parameter validation check (Aryan Srivastava)
- Revert "mtd: rawnand: marvell: fix layouts" (Aryan Srivastava)
- ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties (Wolfram Sang)
- ARM: dts: renesas: gose: Remove superfluous port property (Wolfram Sang)
- RDMA/rxe: Fix null deref on srq-&gt;rq.queue after resize failure (Zhu Yanjun) [Orabug: 38798867] {CVE-2025-68379}
- sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Kuniyuki Iwashima)
- phy: mscc: Fix PTP for VSC8574 and VSC8572 (Horatiu Vultur)
- arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory (Alexander Martinz)
- arm64: dts: qcom: sm8650: set ufs as dma coherent (Neil Armstrong)
- arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider (Gergo Koteles)
- arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller (Krishna Kurapati)
- arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller (Krishna Kurapati)
- firmware: imx: scu-irq: fix OF node leak in (Peng Fan)
- arm64: dts: ti: k3-am62p: Fix memory ranges for GPU (Randolph Sapp)
- s390/ap: Don't leak debug feature files if AP instructions are not available (Heiko Carstens)
- s390/smp: Fix fallback CPU detection (Heiko Carstens)
- wifi: ath11k: fix peer HE MCS assignment (Baochen Qiang) [Orabug: 38798872] {CVE-2025-68380}
- wifi: ath11k: fix VHT MCS assignment (Baochen Qiang)
- crypto: hisilicon/qm - restore original qos values (Nieweiqiang)
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (Thorsten Blum) [Orabug: 38798874] {CVE-2025-68724}
- soc: qcom: gsbi: fix double disable caused by devm (Xu Wang)
- soc: Switch back to struct platform_driver::remove() (Uwe Kleine-König)
- clk: qcom: camcc-sm7150: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (Li Qiang)
- PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (Geert Uytterhoeven)
- arm64: dts: exynos: gs101: fix sysreg_apm reg property (Peter Griffin)
- perf annotate: Check return value of evsel__get_arch() properly (Tianyou Li)
- arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 (Tim Harvey)
- arm64: dts: imx8mp-venice-gw702x: remove off-board uart (Tim Harvey)
- arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl (Tim Harvey)
- arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props (Tim Harvey)
- block/mq-deadline: Switch back to a single dispatch list (Bart Van Assche)
- block/mq-deadline: Introduce dd_start_request() (Bart Van Assche)
- firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc (Randy Dunlap)
- iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (Francesco Lavra)
- inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() (Luoxuanqiang)
- inet: Avoid ehash lookup race in inet_ehash_insert() (Luoxuanqiang)
- rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() (Luoxuanqiang)
- clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets (Stephan Gerhold)
- ntfs3: Fix uninit buffer allocated by __getname() (Sidharth Seela)
- ntfs3: fix uninit memory after failed mi_read in mi_format_new (Raphael Pinsonneault-Thibeault)
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Herbert Xu)
- irqchip/qcom-irq-combiner: Fix section mismatch (Johan Hovold)
- irqchip/starfive-jh8100: Fix section mismatch (Johan Hovold)
- irqchip/renesas-rzg2l: Fix section mismatch (Johan Hovold)
- irqchip/imx-mu-msi: Fix section mismatch (Johan Hovold)
- irqchip/irq-brcmstb-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7120-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7038-l1: Fix section mismatch (Johan Hovold)
- sched/fair: Forfeit vruntime on yield (Fernand Sieber)
- wifi: ath11k: restore register window after global reset (Baochen Qiang)
- wifi: ath10k: move recovery check logic into a new work (Kang Yang)
- wifi: ath10k: Add missing include of export.h (Jeff Johnson)
- wifi: ath10k: Avoid vdev delete timeout when firmware is already down (Loic Poulain)
- objtool: Fix weak symbol detection (Josh Poimboeuf)
- objtool: Fix standalone --hacks=jump_label (Dylan Hatch)
- HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (Mavroudis Chatzilazaridis)
- drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() (Cyrille Pitchen)
- clk: renesas: cpg-mssr: Read back reset registers to assure values latched (Marek Vasut)
- clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register (Thierry Bultel)
- clk: renesas: Use str_on_off() helper (Geert Uytterhoeven)
- clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (Marek Vasut)
- pinctrl: renesas: rzg2l: Fix PMC restore (Biju Das)
- USB: Fix descriptor count when handling invalid MBIM extended descriptor (Seungjin Bae)
- drm/vgem-fence: Fix potential deadlock on release (Janusz Krzysztofik) [Orabug: 38818211] {CVE-2025-68757}
- accel/ivpu: Fix DCT active percent format (Karol Wachowski)
- accel/ivpu: Make function parameter names consistent (Jacek Lawrynowicz)
- drm/panel: visionox-rm69299: Don't clear all mode flags (Guido Günther)
- accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail (Karol Wachowski)
- accel/ivpu: Prevent runtime suspend during context abort work (Andrzej Kacprowski)
- gpu: host1x: Fix race in syncpt alloc/free (Mainak Sen) [Orabug: 38798898] {CVE-2025-68732}
- smack: fix bug: setting task label silently ignores input garbage (Konstantin Andreev)
- smack: fix bug: unprivileged task can create labels (Konstantin Andreev)
- smack: fix bug: invalid label of unix socket file (Konstantin Andreev)
- smack: always "instantiate" inode in smack_inode_init_security() (Konstantin Andreev)
- smack: deduplicate xattr setting in smack_inode_init_security() (Konstantin Andreev)
- smack: fix bug: SMACK64TRANSMUTE set on non-directory (Konstantin Andreev)
- smack: deduplicate "does access rule request transmutation" (Konstantin Andreev)
- net/mlx5e: Set default burst period for TX and RX reporters (Shahar Shitrit) [Orabug: 38636804]
- devlink: Make health reporter burst period configurable (Shahar Shitrit) [Orabug: 38636804]
- devlink: Introduce burst period for health reporter (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move health reporter recovery abort logic to a separate function (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move graceful period parameter to reporter ops (Shahar Shitrit) [Orabug: 38636804]
- devlink: use devlink_nl_put_u64() helper (Przemek Kitszel) [Orabug: 38636804]
- devlink: introduce devlink_nl_put_u64() (Przemek Kitszel) [Orabug: 38636804]
- Revert "net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery" (Qing Huang) [Orabug: 38636804]
- net/rds: improve conn destroy printk message (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: expand kref coverage to rds_notifier-&gt;n_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: rds_sendmsg must use rs_conn only when not being destroyed (Sharath Srinivasan) [Orabug: 38728742]
- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang) [Orabug: 38766139]
- mm: list_lru: avoid using NULL list_lru_one. (Imran Khan) [Orabug: 38787957]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg)
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa)
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn)
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe)
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping)
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen)
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan)
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo) [Orabug: 38847806] {CVE-2025-68789}
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera)
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38649136]  {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.1.el10uek]" date="1769688000">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang)  [Orabug: 38899652]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.2.el10uek]" date="1770897600">- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan)  [Orabug: 38937451]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.3.el10uek]" date="1771329600">- net/rds: Fix issue with a revert in rds_send_queue_rm (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
</package>
<package pkgid="285f67de0f34c7266d969518446f6a25a08819a0" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="109.67.6.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg) [Orabug: 38887626] {CVE-2025-71156}
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa) [Orabug: 38887628] {CVE-2025-71157}
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn) [Orabug: 38887618] {CVE-2025-71154}
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe) [Orabug: 38887603] {CVE-2025-71149}
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping) [Orabug: 38887600] {CVE-2025-71148}
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen) [Orabug: 38887596] {CVE-2025-71147}
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan) [Orabug: 38887608] {CVE-2025-71151}
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo)
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera) [Orabug: 38887785] {CVE-2025-71146}
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.6.el10uek]" date="1772884800">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong)  [Orabug: 39027305]</changelog>
</package>
<package pkgid="7b09810dc2423b25ba5a415afb88a8d28622904a" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315]</changelog>
</package>
<package pkgid="d1f7a985cab15c49433e06a251a165276778fd22" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-200.74.27.2.el10uek]" date="1775649600">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39186444]  {CVE-2025-40135} 
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39181102]  {CVE-2026-23231} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39181101]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="0c97c31347be6a8f7e8eef748ebd6c6affc760af" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]  
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]  
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
</package>
<package pkgid="7e7a01d1c32a907cd62da5288d94ff87f0787d20" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]  
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]  
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="d9c56670b8fb39254d7c767e2d6c41853e6eb41d" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]  
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]  
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431} 
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]  
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]  
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]  
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
</package>
<package pkgid="d5177f65368d907fcb3b3e3b0be2abd26b81dfd1" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-201.74.2.3.el10uek]" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39342689]  {CVE-2026-43500} 
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39342689]  
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39342689]  
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39342689]  
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39342689]  {CVE-2026-43284}</changelog>
</package>
<package pkgid="e07a3fc3bd1bca28574e4171f370bd07880bf608" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck)
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park)
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong)
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck)
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu)
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong)
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N)
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He)
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin)
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian)
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko)
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu)
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N)
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo)
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement)
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K)
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen)
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy)
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle)
- kexec: derive purgatory entry from symbol (Li Chen)
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao)
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez)
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey)
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang)
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev)
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong)
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong)
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson)
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo)
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig)
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav)
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed)
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang)
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao)
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal)
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal)
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li)
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li)
- media: radio-keene: fix memory leak in error path (Shaurya Rane)
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack)
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack)
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack)
- HID: hid-pl: handle probe errors (Oliver Neukum)
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson)
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers)
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han)
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian)
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski)
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu)
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni)
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo)
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi)
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo)
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa)
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen)
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai)
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt)
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov)
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal)
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li)
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni)
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek)
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui)
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith)
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith)
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai)
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan)
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan)
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus)
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook)
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek)
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin)
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu)
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao)
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi)
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen)
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang)
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li)
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab)
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab)
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab)
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab)
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang)
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho)
- gfs2: fiemap page fault fix (Andreas Gruenbacher)
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang)
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn)
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150]
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116]
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972]
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500} 
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]  
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513]  
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]  
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]  
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]  
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284} 
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
</package>
<package pkgid="1b8a72f2a9325413d30cefcc7c71174e1ebaaeb9" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974] {CVE-2026-43129}
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270} 
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278} 
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
</package>
<package pkgid="ad889f6c7f56069c38337dd7b78c8a69aff6f11f" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278}
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-202.76.4.3.el10uek]" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391434]  {CVE-2026-46333}</changelog>
</package>
<package pkgid="ea093abd38b7db48aee200d7dde360b26c610560" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278}
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-202.76.4.3.el10uek]" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391434]  {CVE-2026-46333}</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.4.el10uek]" date="1779364800">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39420559]  {CVE-2026-46300} 
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39420559]</changelog>
</package>
<package pkgid="2953a9e44bdfebac7c21deb330c9620cca01572e" name="kernel-uek-debug" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="203.76.7.1.el10uek"/>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) [Orabug: 39227772] {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) [Orabug: 39251164] {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) [Orabug: 39251169] {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) [Orabug: 39262447] {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) [Orabug: 39331678] {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) [Orabug: 39331784] {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) [Orabug: 39300554] {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) [Orabug: 39331889] {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) [Orabug: 39331303] {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) [Orabug: 39331577] {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) [Orabug: 39339241] {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) [Orabug: 39343623] {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) [Orabug: 39331924] {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) [Orabug: 39331696] {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) [Orabug: 39331680] {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) [Orabug: 39331661] {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) [Orabug: 39331512] {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) [Orabug: 39331937] {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) [Orabug: 39331435] {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) [Orabug: 39331422] {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) [Orabug: 39343538] {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) [Orabug: 39331504] {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) [Orabug: 39331827] {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) [Orabug: 39343546] {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) [Orabug: 39331482] {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) [Orabug: 39331693] {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) [Orabug: 39331458] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) [Orabug: 39331580] {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) [Orabug: 39331409] {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) [Orabug: 39331341] {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) [Orabug: 39331444] {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) [Orabug: 39331510] {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) [Orabug: 39331358] {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) [Orabug: 39331954] {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) [Orabug: 39331545] {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) [Orabug: 39331821] {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) [Orabug: 39331705] {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) [Orabug: 39331366] {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) [Orabug: 39331866] {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) [Orabug: 39331752] {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) [Orabug: 39331370] {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) [Orabug: 39331846] {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) [Orabug: 39331389] {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) [Orabug: 39331440] {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) [Orabug: 39343613] {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) [Orabug: 39331353] {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) [Orabug: 39331023] {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) [Orabug: 39331012] {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) [Orabug: 39331761] {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) [Orabug: 39331606] {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) [Orabug: 39331628] {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) [Orabug: 39331331] {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) [Orabug: 39331449] {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) [Orabug: 39331361] {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) [Orabug: 39331875] {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) [Orabug: 39331549] {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) [Orabug: 39331496] {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) [Orabug: 39331383] {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) [Orabug: 39331959] {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) [Orabug: 39343626] {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [Orabug: 39343577] {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) [Orabug: 39331591] {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) [Orabug: 39343531] {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) [Orabug: 39331853] {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) [Orabug: 39331859] {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) [Orabug: 39343609] {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) [Orabug: 39331003] {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) [Orabug: 39343515] {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) [Orabug: 39331318] {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) [Orabug: 39331375] {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) [Orabug: 39343527] {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) [Orabug: 39331585] {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) [Orabug: 39343616] {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) [Orabug: 39331719] {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) [Orabug: 39331807] {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) [Orabug: 39343628] {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) [Orabug: 39331070] {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) [Orabug: 39331308] {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) [Orabug: 39343581] {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) [Orabug: 39331918] {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) [Orabug: 39343603] {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) [Orabug: 39331896] {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) [Orabug: 39331636] {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) [Orabug: 39331947] {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) [Orabug: 39331518] {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) [Orabug: 39331877] {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) [Orabug: 39331789] {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) [Orabug: 39331882] {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) [Orabug: 39331312] {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) [Orabug: 39331077] {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 38649060,39186444,39202432] {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet) [Orabug: 38887740,39181101,39202431] {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera) [Orabug: 39029337,39131054] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe) [Orabug: 39144150,39343763] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao) [Orabug: 38970584,39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A) [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu) [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu) [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu) [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu) [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu) [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski) [Orabug: 39166116]</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.1.el10uek]" date="1776772800">- Revert "EDAC: Octeon: Init SDEI" (Jeremy Tang) [Orabug: 39203407]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.2.el10uek]" date="1777464000">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman) [Orabug: 39276980]
- uek-rpm/config-aarch64: Enable NVIDIA-recommended Vera-Rubin configs (Vijay Kumar) [Orabug: 39157707]
- kselftest/arm64: Add HWCAP test for FEAT_LS64 (Yicong Yang) [Orabug: 39157707]
- arm64: Provide basic EL2 setup for FEAT_{LS64, LS64_V} usage at EL0/1 (Yicong Yang) [Orabug: 39157707]
- perf: arm_spe: Relax period restriction (Leo Yan) [Orabug: 39157707]
- perf/arm_cspmu: Add PMEVFILT2R support (Robin Murphy) [Orabug: 39157707]
- ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional (Lifeng Zheng) [Orabug: 39157707]
- dt-bindings: gpio: Add Tegra256 support (Prathamesh Shete) [Orabug: 39157707]
- perf/arm_cspmu: nvidia: Add revision id matching (Besar Wicaksono) [Orabug: 39157707]
- arm64: Handle BRBE booting requirements (Anshuman Khandual) [Orabug: 39157707]
- arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again (Rob Herring) [Orabug: 39157707]
- arm64/gcs: Provide basic EL2 setup to allow GCS usage at EL0 and EL1 (Mark Brown) [Orabug: 39157707]
- tools headers arm64: Add NVIDIA Olympus part (Besar Wicaksono) [Orabug: 39157707]
- perf arm-spe: Add NVIDIA Olympus to neoverse list (Besar Wicaksono) [Orabug: 39157707]
- perf arm_spe: Add CPU variants supporting common data source packet (Leo Yan) [Orabug: 39157707]
- arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Yicong Yang) [Orabug: 39157707]
- perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Yicong Yang) [Orabug: 39157707]
- perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions (Yicong Yang) [Orabug: 39157707]
- perf/arm_cspmu: nvidia: Add pmevfiltr2 support (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Add pmpidr support (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Move register definitons to header (Robin Murphy) [Orabug: 39157707]
- perf/arm_cspmu: Add callback to reset filter config (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Generalise event filtering (Robin Murphy) [Orabug: 39157707]
- perf: arm_pmuv3: Add support for the Branch Record Buffer Extension (BRBE) (Rob Herring) [Orabug: 39157707]
- arm64/sysreg: Add BRBE registers and fields (Anshuman Khandual) [Orabug: 39157707]
- perf: arm_pmu: Move PMUv3-specific data (Mark Rutland) [Orabug: 39157707]
- perf: apple_m1: Don't disable counter in m1_pmu_enable_event() (Rob Herring) [Orabug: 39157707]
- perf: arm_v7_pmu: Don't disable counter in (armv7|krait_|scorpion_)pmu_enable_event() (Rob Herring) [Orabug: 39157707]
- perf: arm_v7_pmu: Drop obvious comments for enabling/disabling counters and interrupts (Rob Herring) [Orabug: 39157707]
- perf: arm_pmuv3: Don't disable counter in armv8pmu_enable_event() (Mark Rutland) [Orabug: 39157707]
- ACPI: CPPC: Rename EPP constants for clarity (Sumit Gupta) [Orabug: 39157707]
- ACPI: CPPC: Add three functions related to autonomous selection (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel() (Lifeng Zheng) [Orabug: 39157707]
- cpufreq/amd-pstate: Store the boost numerator as highest perf again (Mario Limonciello) [Orabug: 39157707]
- ACPI: CPPC: Refactor register value get and set ABIs (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Add cppc_set_reg_val() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Extract cppc_get_reg_val_in_pcc() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Optimize cppc_get_perf() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu() (Jie Zhan) [Orabug: 39157707]
- ACPI: CPPC: Clean up cppc_perf_caps and cppc_perf_ctrls structs (Sumit Gupta) [Orabug: 39157707]
- cpufreq: CPPC: Add generic helpers for sysfs show/store (Sumit Gupta) [Orabug: 39157707]
- cpufreq: CPPC: Add support for autonomous selection (Lifeng Zheng) [Orabug: 39157707]
- PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (Nirmoy Das) [Orabug: 39157707]
- PCI: Add ASPEED vendor ID to pci_ids.h (Nirmoy Das) [Orabug: 39157707]
- i2c: tegra: Add support for SW mutex register (Kartik) [Orabug: 39157707]
- i2c: tegra: Use internal reset when reset property is not available (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add HS mode support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Update Tegra256 timing parameters (Akhil R) [Orabug: 39157707]
- i2c: tegra: Use separate variables for fast and fastplus (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add Tegra264 support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add Tegra256 support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Do not configure DMA if not supported (Kartik) [Orabug: 39157707]
- gpio: tegra186: Fix GPIO name collisions for Tegra410 (Kartik) [Orabug: 39157707]
- gpio: tegra186: Use generic macro for port definitions (Kartik) [Orabug: 39157707]
- gpio: tegra186: Add support for Tegra410 (Prathamesh Shete) [Orabug: 39157707]
- gpio: tegra186: Add support for Tegra256 (Prathamesh Shete) [Orabug: 39157707]
- arm64: acpi: Enable ACPI CCEL support (Suzuki K Poulose) [Orabug: 39157707]
- arm64: Enable EFI secret area Securityfs support (Suzuki K Poulose) [Orabug: 39157707]
- arm64: realm: ioremap: Allow mapping memory as encrypted (Suzuki K Poulose) [Orabug: 39157707]
- arm64: Document Arm Confidential Compute (Steven Price) [Orabug: 39157707]
- virt: arm-cca-guest: TSM_REPORT support for realms (Sami Mujawar) [Orabug: 39157707]
- arm64: Enable memory encrypt for Realms (Suzuki K Poulose) [Orabug: 39157707]
- arm64: mm: Avoid TLBI when marking pages as valid (Steven Price) [Orabug: 39157707]
- arm64: Enforce bounce buffers for realm DMA (Steven Price) [Orabug: 39157707]
- efi: arm64: Map Device with Prot Shared (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Map unprotected MMIO as decrypted (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Add support for checking whether an MMIO is protected (Suzuki K Poulose) [Orabug: 39157707]
- arm64: realm: Query IPA size from the RMM (Steven Price) [Orabug: 39157707]
- arm64: Detect if in a realm and set RIPAS RAM (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Add RSI definitions (Suzuki K Poulose) [Orabug: 39157707]
- PCI/TPH: Add TPH documentation (Wei Huang) [Orabug: 39157707]
- PCI/TPH: Add Steering Tag support (Wei Huang) [Orabug: 39157707]
- PCI: Add TLP Processing Hints (TPH) support (Wei Huang) [Orabug: 39157707]
- sched: Update rq-&gt;avg_idle when a task is moved to an idle CPU (Shubhang Kaushik) [Orabug: 39214522]
- arm64: mte: Set TCMA1 whenever MTE is present in the kernel (Carl Worth) [Orabug: 39214522]
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov) [Orabug: 39241227,39273721] {CVE-2026-31628}
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp) [Orabug: 39252919]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp) [Orabug: 39259550]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.3.el10uek]" date="1777982400">- sched/deadline: Use revised wakeup rule for dl_server (Peter Zijlstra)
- netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [Orabug: 39339273] {CVE-2026-43084}
- netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -&gt; GFP_KERNEL_ACCOUNT allocation (Scott Mitchell)
- Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt" (Sasha Levin)
- Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads" (Sasha Levin)
- iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() (Zhen Ni) [Orabug: 39145066]
- iommu/amd: Fix header file (Vasant Hegde) [Orabug: 39145066]
- iommu/amd: Preserve default DTE fields when updating Host Page Table Root (Alejandro Jimenez) [Orabug: 39145066]
- iommu/amd: Enable support for up to 2K interrupts per function (Kishon Vijay Abraham I) [Orabug: 39145066]
- iommu/amd: Rename DTE_INTTABLEN* and MAX_IRQS_PER_TABLE macro (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Replace slab cache allocator with page allocator (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Introduce generic function to set multibit feature value (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Remove amd_iommu_apply_erratum_63() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Lock DTE before updating the entry with WRITE_ONCE() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Modify clear_dte_entry() to avoid in-place update (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce helper function get_dte256() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Modify set_dte_entry() to use 256-bit DTE helpers (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce helper function to update 256-bit DTE (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce struct ivhd_dte_flags to store persistent DTE flags (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Misc ACPI IVRS debug info clean up (Suravee Suthikulpanit) [Orabug: 39145066]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39250685,39331108] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [Orabug: 39250685]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug: 39250685,39300909] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250685]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le) [Orabug: 39250685]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug: 39250685,39283866,39291972,39292190] {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250685]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers) [Orabug: 39250685]
- iommu/arm-smmu-v3: Handle zeroed A4-2C HTTU override settings (Joao Martins) [Orabug: 39260974]</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.4.el10uek]" date="1778587200">- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39218893]  {CVE-2025-54518}
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39334587]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39334587]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39334587]
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39334587]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39334587]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39334587]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39334587]  {CVE-2026-43284}
- bcm-hsdk-gpl: Fix build issues for HSDK 6.5.34 (Vijay Kumar)  [Orabug: 39342234]
- bcm-hsdk-gpl: Update BCM HSDK GPL driver to 6.5.34 (Vijay Kumar)  [Orabug: 39342234]
- minke-fan-cpld: Avoid logging 'unknown fan id' when no fan is present (arista-hpandya)  [Orabug: 39335238]
- exadata: tools: perf: update column to comm_nodigit (Stephen Brennan)  [Orabug: 39327035]
- perf report: Add comm_nodigit sort key (Stephen Brennan)  [Orabug: 39327035]
- Revert "tools: perf: add comm_ignore_digit column" (Stephen Brennan)  [Orabug: 39327035]
- octeontx2-af: cn20k: Fix RVU AF interrupt handler (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Move QMEM allocations from GFP_KERNEL to ATOMIC (Sunil Goutham)  [Orabug: 39318904]
- bphy-pf: CNF20Ka: poll MHABs based on cpri_mask instead of fixed count (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: Add devlink param for NIX RQ caching (Nishok A)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix the RVUAF-&gt;PF mbox address (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add devlink and debugfs support for NPA DWRR registers. (Anshumali Gaur)  [Orabug: 39318904]
- cn20k-af: psw: Fix build warning (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix AI review comments. (Ratheesh Kannoth)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox to write to PSW MSIX registers (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add debugfs support for psw (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: introduce a mailbox to program PSW mbox msix vector (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add PSW AF API Notification queue support (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add FLR handler for PSW (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setup PSW timed polling structure tables (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW PCIe configuration (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW LF mapping (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add new mailbox for PSW doorbell configuration (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setups PSW FID resources (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setup PSW GID resources (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox to get PSW capabilities (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: register PSW AF interrupts (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: introduce PSW block (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: limit max periodic timers for cn20k (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Make default entries as x4. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeonxt2-af: npc: Fix bugs (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2_unregister_dl() after kernel reboot. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2vf_remove after kernel reboot. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: cn20k: Configure default CPT_AF_UCC_CTL for IPsec error codes (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: CN20k: add support for RFOE4 on half MP (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: Fix kernel crash during eswitch creation (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Use ZERO_OR_NULL_PTR for cgxchan2link_map (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add parser configuration for VLAN extraction (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support for single SBTAG parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix SDP channel base (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add MCS DSA tag parsing configuration support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Avoid any false positives for Altaf (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npc: Fix broadcast MCAM entry type on CN10K (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add platform check. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-bphy-netdev: add get_link_ksettings to fix SIOCETHTOOL error (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: dont free default mcam indexes (Ratheesh Kannoth)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Replace deprecated MSI-X API in CPRI netdev driver (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix kernel warn. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Mismatch stats. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Dont free PF default mcam indexes. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: FIx invalid access (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: dstats (Ratheesh Kannoth)  [Orabug: 39318904]
- octeonxt2-af: npc: cn20k: show enable/disable status. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: debugfs for virtual indexes (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix AI reviews (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Alloc default indexes during nix lf alloc (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix default mcam idx free (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: Remove SoC specific local variables. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix SC resource cleanup loop (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs: Add SC CAM bypass entry (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Modify the pcifunc VF mask (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: update the AFPFX_TRIGX reg offset (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: Fix rvu mbox registers offset (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2: sdp: Display backpressure status in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: add bounds check in nix_bp_enable (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: cn20k: Set a default value for res_meta_offset (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: Support mapping of individual slots to RVU block LFs (Subbaraya Sundeep)  [Orabug: 39318904]
- cn20k-af: ml: improve AF register access control (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: fetch list of LF IDs attached (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: fix using uninitialized partition ID (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable mapping LF to partition ID (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable mapping LF with partitions (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support ML lf alloc and free (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support fetching msix offset for ML (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support attach and detach of ML LFs (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: add support to fetch ML capabilities (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: implement ML mbox message handler (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: register ML interrupt handlers (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: implement hw resource setup and free (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable ML block probe and remove (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: add skeleton code for ML EB driver (Prince Takkar)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Add CN20K TX SecY policy bit support (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs: Set default mcs Id to 0. (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix memleak in npc_install flow (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix flags for HWWQE period timers (Mikko Suni)  [Orabug: 39318904]
- octeontx2-af: cn20k: Use physical address for AF-&gt;PF mbox (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: update fields of CPT_AF_LFX_CTL (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: cn20k: configure RX inline replay (Shashank Gupta)  [Orabug: 39318904]
- Octeontx2-af: cn20k: configure inline RQ mask (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Don't initialize ipsec queues for representor PF. (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-bphy-pf: CNF20ka: BPHY NIC PF driver for chiplet based BPHY NIX bypass mode (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: fix npc mbox structure defination (Mohit Kumar Parjapat)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Avoid SoC specific structures (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix get number of kw (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: cancel work before destroying wq. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx: switch: Fix compiler warnings. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: selftest: Use unique mbox ids (Linu Cherian)  [Orabug: 39318904]
- octeontx: pan: Disable WQ after unregister notifier (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Define new flag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix bugs. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Update mcam_idx for reply flow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Support ovs offloading (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Support mask as well for flow. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Pass tuple mask as well to flow. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Retrieve VLAN infor for L3 routing (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Add vlan tag as part of message (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Dont process events if switchdev is not up (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: make functions static (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix graceful shutdown. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Notify switchdev on NF table callback (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Support SNAT/DNAT routing (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Reject acceleration for invalid bridge (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Fix buffer overflow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix below kernel splat (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switchdev: Register for Route events. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switchdev: Forward route notifications. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switchdev: Add driver support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switchdev: L2 offload support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Remove devlink support for SDP VF NIC driver (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: Handle pool context address update in Aura context write (Ashwin Sekhar T K)  [Orabug: 39318904]
- octeontx2-af: CN20k: fix unused-function warning (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-pf: Move representor event handling into common file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix Rep link state sync up with PF/VFs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Fix DPC config mbox (Ashwin Sekhar T K)  [Orabug: 39318904]
- Octeontx2-pf: Fix transceiver details corruption (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: change GEN PF device ID (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20K: Fetch LBK supported channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix limiting SRIOV VF count logic (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: Fix KASAN slab-out-of-bounds error (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: Update irq affinity for mbox and flr (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add FLR/ME support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Fix possible memleak while mbox init (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Map alternative AF NIX_AF_GINT only for CN10K (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support to forward error interrupts to alt AF (Anil Kumar Reddy)  [Orabug: 39318904]
- octeontx2-af: Add support to forward flr to alternative AF (Anil Kumar Reddy)  [Orabug: 39318904]
- octeontx2-af: Update Alternative AF status (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: cn20k: Cleanup AF interrupt vector (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Do not hardcode AF bus number in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix rsrc_alloc debugfs file (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Add devlink option to reset MAC stats for debugging (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add devlink for defrag initiation (Ratheesh Kannoth)  [Orabug: 39318904]
- net: octeontx2: Fix coding style issues (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: Fix mcs string buffer size (Stefan Wiehler)  [Orabug: 39318904]
- octeontx2-af: Skip TM tree print for disabled SQs (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: debugfs: Add cn20k sdp rings info (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix kernel crash during NIX TM register dump (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: cpt: Add debug support for more than 64 engines. (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Update engine offset calculation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Add support to display "Autoneg" (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-vf: Set tc filter flag on vf netdev (Suman Ghosh)  [Orabug: 39318904]
- Octeontx2-pf: Update link mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-pf: Fix ethtool eeprom read logic (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: ethtool: Display physical connector type (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: restart interface when link settings are changed by user (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-sdpvf: Fix PTP options for SDP interfaces (Roy Franz)  [Orabug: 39318904]
- octeontx2-vf: Add partial ethtool support for SDP VFs (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Add page pool stats to ethtool (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Add missing changes in otx2_ethtool.c (Suman Ghosh)  [Orabug: 39318904]
- Octeontx2-pf: tc: fix egress ratelimiting (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Support to enable EDSA/Higig2 pkts parsing (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Using compound/head page ref count (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Fix NDC sync operation errors (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: cn20k: fix target address (Juan Garcia)  [Orabug: 39318904]
- octeontx2-pf: Check address for Null before free (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Add soft reset sequence in mcs_global_cfg() (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-pf: mcs: Don't account field alignment when installing TX SecY policy (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix start and end bit for scan config (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: npc: cn20k: Remove function (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: npc: cn20k: refactor code (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cgx: misc changes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: reset TL1 SW_XOFF before returning from link mode change (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Remove MAC address validation check (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Show count of dropped packets by DMAC filters (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Update mbox version (Sunil Goutham)  [Orabug: 39318904]
- cn10k-ipsec: Fix compilation with XFRM_OFFLOAD enabled (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-vf: Register dummy netdev for host PF VFs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Configure SQ default channel based on UP message (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Dereference only a valid pointer (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-vf: Fix VF mbox up message error on PTP RX enable (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: Add support for creating netdev interfaces for SDP VFs (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Add more debug messages (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Send UP messages to VF only when VF is up. (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Avoid null pointer dereference (Subbaraya Sundeep)  [Orabug: 39318904]
- cn10k-ipsec: fix uninitialized send queue during ESP offload (Shashank Gupta)  [Orabug: 39318904]
- cn10k-ipsec: Initialize ipsec queues on enabling IPsec (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: cn10k/cn20k: Update count_eot in NPA_LF_AURA_BATCH_FREE0 (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: persist netdev stats across routine operations (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-pf: Add self test (Linu Cherian)  [Orabug: 39318904]
- octeontx2-pf: Add ethtool -m option support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Skip dma map and unmap when IOMMU is bypassed (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-pf: Add NIXLF error/poison interrupt handlers (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-pf: Validation for TL1 Round robin priority (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: devlink param support to modify physical interface links. (Rakesh Babu)  [Orabug: 39318904]
- octeontx2-pf: Add devlink param to vary rbuf size (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Add devlink param to vary cqe size (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: CN20k: add multi chiplet support to NIX path (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Enable TX PTP timestamping on BPHY NIX link (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cn10k: Fix accessing invalid CSRs (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: fix fwdata NULL pointer dereference when RPM probe fails (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Map BPHY chiplet RPMs followed by compute chiplet RPMs (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Add chiplet RPM AF mbox support for port ready, get channel info messages. (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cnf20k: account for XCB RPM links in CGX link calculation (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Add support for chiplet based BPHY RPM driver as AF RVU extension block module (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Add BPHY chiplet, RPM, LMAC data to fwdata (Sai Krishna)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Register driver with PCI subsys ID (Anshumali Gaur)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Fix MSI-X init failure by setting both DMA masks (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20K: Add build and config support for CPRI PF driver to avoid module conflicts (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Fix CPRI MSI-X initialization failure (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Add workaround for gpint issue for CPRI pkt path (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Add cpri netdev driver support (Viswajith Murali)  [Orabug: 39318904]
- octeontx-bphy-netdev: Fix unexpected packet in netdev by ensuring proper PSW hardware write handling (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-bphy-netdev: allow forcing ts steps cnt (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix fec counters reporting (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix ecpri pkt stats update (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix ecpri type5 handling (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix a deadlock in cpri (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix race condition for timestamp packets (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix kernel crash by using proper max PSM queue count (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: protect psm queue access (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix debugfs memleak (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Detect DL circular buffer full (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix rsfec stats reading (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Support for eCPRI MsgType5 timestamping (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Use correct netdev priv structure for debugging (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: disable CPRI RX on cleanup (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: ignore mcs untagged error (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: disable rx on RFOEs on exit (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix crash issue during initialization of cpri, rfoe interfaces on set MAC address (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: OcteonTX2 Base PHY RFOE netdev driver (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver msix, interrupt handling (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Move DPI block reset handling to AF extension block driver (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver channel table mbox support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver mbox support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver initial support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cn20k: Don't reset the PF_DISC register (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: CN20K: update RPM links (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add block discovery register (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix PTP RX enable mbox fail issue over NIC VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Modify NIX register offset value for CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Validate NIX maximum LFs correctly (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix incorrect BPID initialization for CPT channels (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow CPT PF access to CPT_AF_GRPX_THR (Shashank Gupta)  [Orabug: 39318904]
- octeontx2-af: cn20k: support packet data buffer (pdb) configuration (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Set LBK channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix config parameter check when disable inline queue (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable CPT parse and Frag info header byte swap (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Add an MCAM entry to count CPT 2nd pass miss packets (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: support overriding aura to zero for second pass (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Use proper mask to get max CPT LF's (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: allow mbox access from CPT VFs for backward compatibility (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: Drop CPT PF/VF check for relevant mboxes (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Change CPT channels configuration (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow CPT PF access to CPTX_AF_CTX_PSP_TIMER_CTL (Shashank Gupta)  [Orabug: 39318904]
- octeontx2-af: cn20k: change CPT register address as per latest csr (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow access to CPT_AF_UCCX_CTL (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: CN20K channel configuration (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable RXC on inline inbound cptlf (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix RXC flush and cleanup sequence (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add CPT CTX flush support (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: fix CPT ctx flush (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: cn20k: Setup CPT reassembly Queue Configuration Register (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Move RXC specific functions (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: cn20k: handle multi-queue reassembly teardown (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for NIX RX inline configuration (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for CPT RX inline configuration (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for CPT RX queue allocation (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mbox to configure rx inline nixlf (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mbox to configure rx inline profile (Bharat Bhushan)  [Orabug: 39318904]
- crypto: octeontx2: Add new mailbox to set queue priority (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add rxc teardown support (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add queue id to rxc time config mbox (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add cpt stats mailbox support (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: add FLT interrupts (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: Unify HW interrupt APIs (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx-af: cpt: Get CPT PF number using PF Device ID (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Update max engine calculation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Add TC rules support for CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Set correct sequence for carrier off and tx queue stop (Suman Ghosh)  [Orabug: 39318904]
- octeontx2: Fix klockwork issues. (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Free queue memory allocated sq timestamp (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Check for DMAC extraction support before setting DMAC based hardware filter for a VF (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Move REP devlink APIs to separate file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix representor up notification events (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Use ews_rules value to update REP tcam rules (Geetha sowjanya)  [Orabug: 39318904]
- Octeontx2-af: Change args for rvu_get_pf (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add validation before accessing fwdata (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: map management port always to first PF (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: replace generic error codes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: link mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Assign CGX id from PCI revision id (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Remove MAC address validation check (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: lmac validation with is_lmac_valid (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix compilation warning/klockwork issues (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: configure 802.3 pause frames in SGMII/QSGMII mode (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add new CGX_CMDs to set and get PHY modulation type (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Do not allow VFs to overwrite PKIND config (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Put CGX LMAC also in Higig2 mode (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-sdp: Add FLR interrupts for Host PFs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Refactor SDP interrupts code (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Fix SDP channel numbers in NPC rules (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Check whether SDP block is present before access (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: sdp: Fix address range assignment logic (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: sdp: Maintain host to RVU GEN PF mapping (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: misc SDP fixes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx-af: cn20k: Manage rings allocation and freeing (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: CN20K: SDP mbox framework (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: CN20K: SDP extension driver (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-pf: enable AF_XDP zero copy support (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix clearing TL3_TL2X_LINKX_CFG[ENA] during SMQ flush to drop packets (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Fix ROCEV2 RSS hashing QP ID length (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Allow to set CPT result address offset (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for NIX flow vector configuration (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: add ROCEv2 header for RSS hashing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Update lbk maximum frame size as per CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: fix TX scheduler count (Satha Rao)  [Orabug: 39318904]
- octeontx2-af: Fix the issue of infinite loop in nix_aq_reset (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Misc changes in NIX block (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Dump hw register state on error (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add new mailbox to configure LSO alt flags (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Extend SPI to SA index translation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: notify VF about ptp event (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: Sending tsc value to the userspace (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: Support for PTP notification to PF (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: npa: fix DPC permit register access (Ashwin Sekhar T K)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add DPC support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add debugfs support for Halo (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add NPA Halo support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Fix number of entries in the kpu3 cam (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix subbank count (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix number of entries in the kpu2 cam (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add mbox to read default rule (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: kpu: Input validation check. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: kpu: Fix lodable profile issue (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Convert to C99 flexible array (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Restore stats in defrag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Flow delete and free mbox (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Add traces in NPC mailboxes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix KPU9 state variable for ROCEV2 (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add support for ROCEv2 header parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add more VLAN tag parsing in case of E-tag (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flags for cn20k (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Avoid updating cn10k registers during cn20k reboot (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Do not access match stats for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: Update NPC CSRs (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix out of bound access in entry2counter array (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix initialization of mcam's entry2target_pffunc field (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flag extraction in parse nibble (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix CPT CGX channel mask for cn20k (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flag in KPU profile for CN20K (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: fix mcam hit counter (Satheesh Paul)  [Orabug: 39318904]
- Revert "octeontx2-af: npc: cn20k: Get base steer rule index." (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: fix rule type for LBK VF (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: Fix failed to load custom pfl warning (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: add changes to update CPT pad length offset in KPU (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix search order (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: Use dev_dbg() (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix compilation warnings (Sunil Goutham)  [Orabug: 39318904]
- octeontx2: cn20k: npc: Set action2 for x2 entries. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable action2 programming in npc (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Set default profile DYNAMIC (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix csr register field offset. (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Reject request for x4 entries in x2 profile. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Alloc mcam entry for install flow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Disable fw load faiure warning (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Load custom kpu profile from filesystem. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix install flow priority (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add support for custom mkex profiles (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Get base steer rule index. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Stats support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cn20k: Reject mcam alloc mbox with invalid keytype (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Reserve x4 key mcam entries for ntuple (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Get kex related info from PF. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix parse result nibble mask reading. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Set correct nibble bits for cn20k (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix parse nibble mask (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Avoid accessing cn10k registers (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add new mailboxes for CN20K silicon (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix npc_mcam_get_hit_status mbox for cn10k (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Convert vidx to mcam_idx in mbox handler (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add an mbox interface to defrag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: defragmentation support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Introduce virtual mcam index (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Validate mcam index before enable/disable (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add new mailboxes to get kex config and free counts (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Use common APIs to read/write/copy/enable mcam entry (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Add a new mbox to read/write MCAM hit status (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: debugfs support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Use common APIs to alloc/free/get mcam index. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Allocate default mcam indexes. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Modify alloc entry mailbox (Suman Ghosh)  [Orabug: 39318904]
- ocetontx2-af: npc: cn20k: MKEX profile support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: KPM profile changes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Index management. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: Fix klockwork issues. (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix Support of FDSA tag (George Cherian)  [Orabug: 39318904]
- octeontx2-af: Support for FDSA tag (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Adding changes to parse stacked VLANs (Kiran Kumar K)  [Orabug: 39318904]
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix issue with GRE parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add support to parse more VLAN headers (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix issue with IPV6 GRE and multi VLAN (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add KPU changes to parse fabric path header (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add few missing changes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: allow second pass pkts via default ucast entry (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: suppress kpu profile loading warning (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: use cpt channel mask in flow install path (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: Add NPC support to filter GTP-U and GTP-C packets based on TEID (Suman Ghosh)  [Orabug: 39318904]
- octeontx2: cn20k: Assign unique MCS IDs based on PCI enumeration (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-pf: Choose macsec encryption offload per packet (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: mcs: Use new SCI CAM in hardware (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: mcs: Fix mcs resources free on PF shutdown (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Add devlink parameter to toggle MCS bypass mode (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Display port mapped stats for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add MCS LMAC channel and count configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs set mcs id and silicon check (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix mcs tx_sa_map API (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mcs PN threshold support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: MCS add port configure APIs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: Add MCS parser configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix mcs register offsets (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix unsupported secy stats read (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add MCS support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: mcs: Remove SA stats support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cnf10k-b: mcs: Fix stats reg address (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: rvu: enable mcs fips mailboxes (Ankur Dwivedi)  [Orabug: 39318904]
- octeontx2-af: mcs: add mailboxes for fips (Ankur Dwivedi)  [Orabug: 39318904]
- octeontx2-af: sso: clear all the sets on init (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: tim: add ring priority support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: update TIM interval support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: moderate SSO AF error interrupts (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: lower TIM bucket skip IRQ log level (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: remove GTI clock adjustment (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: update xaq aura offset (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: cleanup SSO EVA on LF reset (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO HW info mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO AGGR config and stats mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO EVA error interrupts (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: update masks for CN20K resources (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: Fixed compilation warnings (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: fix interval flag check (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add TIM hardware info mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add TIM HWWQE mbox support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add mbox to capture counters (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: reveal only TIM params that are available (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: add TIM error af interrupt handlers (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: clear state on TIM ring disable (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: disable preemption when enabling TIM (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: account for cycle wraparound (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: prevent TIM register read reorder (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: fix arguments passed to XAQ aura deinit (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: debugfs: fix undefined SSO register access (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: update TIM adjust GTI errata silicons (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: update TIM adjust GTI errata silicons (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: add TIM adjust GTI errata workaround (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: cn10k: devlink params to configure TIM (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: TIM: Set conditional clock always on (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Apply relevant HW issue workarounds for 96xx B0 silicon (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: Add SSO and TIM units support to the AF driver (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: enable rxc with lookaside cpt lf (Vidya Sagar Velumuri)  [Orabug: 39318904]
- octeontx2-af: fix issue with spitosa table teardown (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: fix cflags include paths (Wladislav Wiebe)  [Orabug: 39318904]
- octeontx2-af: Move out REE mbox messages (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add generic mbox handler for Eblock (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Use AF extension block interface (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add RVU AF extension block interface (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Introducing REE block for 98xx (Smadar Fuks)  [Orabug: 39318904]
- octeontx2-af: fix VF bringup affecting PF promiscous state (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: consider mode when using cpt base channel for bp (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: Update minimum receive frame size (Sathesh Edara)  [Orabug: 39318904]
- octeontx2-af: set default min and max rx len for CPT link (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: add NIX mbox message to get HW info (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: fix inline inbound IPsec configuration (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: support for custom L2 header (Satheesh Paul A)  [Orabug: 39318904]
- octeontx2-af: fix to get different rq mask (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: poll for tx link credits before link mode change (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Handle physical link state change requests (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add mbox to alloc/free BPIDs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Dynamically allocate bpids for CPT and LBK (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support for SPI to SA index translation (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Update HW workarounds for 96xx C0, 98xx and F95xx B0 chips (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add devlink support to configure TL1 RR_PRIO (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: add support for CPT second pass (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: add new mbox to support sync cycle on rx path (Satha Rao)  [Orabug: 39318904]
- octeontx2-af: add support for changing vlan tpid (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-pf: Fix devm_kcalloc() error checking (Dan Carpenter)  [Orabug: 39318904]
- octeontx2-pf: Use new bandwidth profiles in receive queue (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Display new bandwidth profiles too in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Accommodate more bandwidth profiles for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Initialize new NIX SQ context for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Initialize cn20k specific aura and pool contexts (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Skip NDC operations for cn20k (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Extend debugfs support for cn20k NPA (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add cn20k NPA block contexts (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Extend debugfs support for cn20k NIX (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Add cn20k NIX block contexts (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Simplify context writing and reading to hardware (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: convert to ndo_hwtstamp API (Vadim Fedorenko)  [Orabug: 39318904]
- Octeontx2-af: Fix pci_alloc_irq_vectors() return value check (Harshit Mogalapalli)  [Orabug: 39318904]
- Octeontx2-af: Fix missing error code in cgx_probe() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-pf: fix bitmap leak (Bo Sun)  [Orabug: 39318904]
- octeontx2-vf: fix bitmap leak (Bo Sun)  [Orabug: 39318904]
- octeontx2-af: Remove unused declarations (Yue Haibing)  [Orabug: 39318904]
- Octeontx2-af: Fix NIX X2P calibration failures (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-vf: Fix max packet length errors (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Broadcast XON on all channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: use unsigned int as iterator for unsigned values (Simon Horman)  [Orabug: 39318904]
- net: Fix typos (Bjorn Helgaas)  [Orabug: 39318904]
- Octeontx2-af: Debugfs support for firmware data (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: RPM: Update DMA mask (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Disable stale DMAC filters (Subbaraya Sundeep)  [Orabug: 39318904]
- Octeontx2-af: Add programmed macaddr to RVU pfvf (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix error code in rvu_mbox_init() (Dan Carpenter)  [Orabug: 39318904]
- Octeontx2-pf: ethtool: support multi advertise mode (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Introduce mode group index (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx-pf: Update SGMII mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix rvu_mbox_init return path (Subbaraya Sundeep)  [Orabug: 39318904]
- Octeontx2-pf: Fix Backpresure configuration (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: CN20K mbox implementation between PF-VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20K mbox implementation for AF's VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: CN20K mbox REQ/ACK implementation for NIC PF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k mbox to support AF REQ/ACK functionality (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k basic mbox operations and structures (Sai Krishna)  [Orabug: 39318904]
- octeontx2: Set appropriate PF, VF masks and shifts based on silicon (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Avoid typecasts by simplifying otx2_atomic64_add macro (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Annotate mmio regions as __iomem (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: macsec: Get MACSEC capability flag from AF (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Add MACSEC capability flag (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Send Link events one by one (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: NPC: Clear Unicast rule on nixlf detach (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Avoid adding dcbnl_ops for LBK and SDP vf (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Add tracepoint for NIX_PARSE_S (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Add new tracepoint otx2_msg_status (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Add pcifunc also to mailbox tracepoints (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Display names for CPT and UP messages (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: convert dev_dbg to tracepoint in mbox (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Fix ethtool support for SDP representors (Hariprasad Kelam)  [Orabug: 39318904]
- net: octeontx2: Use pure PCI devres API (Philipp Stanner)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP: code clean up (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Remove unused rvu_npc_enable_bcast_entry (Dr. David Alan Gilbert)  [Orabug: 39318904]
- xfrm: Add explicit dev to .xdo_dev_state_{add,delete,free} (Cosmin Ratiu)  [Orabug: 39318904]
- octeontx2-pf: handle otx2_mbox_get_rsp errors (Chenyuan Yang)  [Orabug: 39318904]
- net: octeontx2: Handle XDP_ABORTED and XDP invalid as XDP_DROP (Lorenzo Bianconi)  [Orabug: 39318904]
- octeontx2-af: mcs: Remove redundant 'flush_workqueue()' calls (Chen Ni)  [Orabug: 39318904]
- net: octeontx2: Add metadata support for xdp mode (Lorenzo Bianconi)  [Orabug: 39318904]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 39318904]
- octeontx2: hide unused label (Arnd Bergmann)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP zero copy transmit support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Prepare for AF_XDP (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Reconfigure RSS table after enabling AF_XDP zerocopy on rx queue (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP zero copy receive support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: use xdp_return_frame() to free xdp buffers (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: mcs: Remove dead code and semi-colon from rsrc_name() (Nihar Chaithanya)  [Orabug: 39318904]
- octeontx2-pf: fix error handling of devlink port in rvu_rep_create() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-pf: fix netdev memory leak in rvu_rep_create() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-af: fix build regression without CONFIG_DCB (Arnd Bergmann)  [Orabug: 39318904]
- cn10k-ipsec: Fix compilation error when CONFIG_XFRM_OFFLOAD disabled (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Fix installation of PF multicast rule (Geetha sowjanya)  [Orabug: 39318904]
- cn10k-ipsec: Enable outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Allow ipsec crypto offload for skb with SA (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Process outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Add SA add/del support for outb ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Init hardware for outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Disable backpressure between CPT and NIX (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Move skb fragment map/unmap to common code (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: map skb data as device writeable (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Fix SDP MAC link credits configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Fix spelling mistake "reprentator" -&gt; "representor" (Colin Ian King)  [Orabug: 39318904]
- octeontx2-pf: Adds TC offload support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Implement offload stats ndo for representors (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add devlink port support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add representors for sdp MAC (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Configure VF mtu via representor (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add support to sync link state between representor and VFs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Get VF stats via representor (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add packet path between representor and VF (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add basic net_device_ops (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Create representor netdev (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: RVU representor driver (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Knobs for NPC default rule counters (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Refactor few NPC mcam APIs (Linu Cherian)  [Orabug: 39318904]
- octeontx2-pf: Move shared APIs to header file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Reuse PF max mtu value (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add new APIs for queue memory alloc/free. (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Define common API for HW resources configuration (Geetha sowjanya)  [Orabug: 39318904]
- net: marvell: use ethtool string helpers (Rosen Penev)  [Orabug: 39318904]
- uek: kabi: update kABI files for new symbols (Saeed Mirzamohammadi)  [Orabug: 39268116]
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39167615]  {CVE-2026-31402}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39110670]  {CVE-2026-23278}
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39103229]  {CVE-2026-23270}</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.5.el10uek]" date="1779192000">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39407652]  {CVE-2026-46333}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.6.el10uek]" date="1779796800">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39442660]  {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39442660]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.7.el10uek]" date="1779969600">- tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi)  [Orabug: 39456024]
- tap: free page on error paths in tap_get_user_xdp() (Weiming Shi)  [Orabug: 39456024]
- tun: free page on short-frame rejection in tun_xdp_one() (Weiming Shi)  [Orabug: 39456024]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.7.1.el10uek]" date="1780315200">- smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39474418]</changelog>
</package>
<package pkgid="f8bf30a45d627fc23841c9e423868a3a0a2d0fcc" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="100.28.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.2.el10uek]" date="1751198400">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
</package>
<package pkgid="8d7e5b068aa35c2cc0a9fe2d9ca3bc7812a52d16" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="100.28.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.el10uek]" date="1743681600">- block: prevent calls to should_fail_bio() optimized by gcc (Prasad Singamsetty)  [Orabug: 37782458]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)   
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]  
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]  
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
</package>
<package pkgid="12695c9be5f4e78489175e5f1bedd24dd2412722" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="101.33.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge) [Orabug: 37976747] {CVE-2025-37903}
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi) [Orabug: 37976752] {CVE-2025-37905}
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [Orabug: 37976858] {CVE-2025-37932}
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski) [Orabug: 37976760] {CVE-2025-37907}
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang) [Orabug: 37976762] {CVE-2025-37908}
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh Edara) [Orabug: 37976864] {CVE-2025-37933}
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan) [Orabug: 37976765] {CVE-2025-37909}
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon) [Orabug: 37976771] {CVE-2025-37910}
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang) [Orabug: 37976728] {CVE-2025-37894}
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein) [Orabug: 37976869] {CVE-2025-37934}
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab) [Orabug: 37976773] {CVE-2025-37911}
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh Ap)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya Kn) [Orabug: 37976731] {CVE-2025-37895}
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe) [Orabug: 37976872] {CVE-2025-37935}
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai) [Orabug: 37970918] {CVE-2025-37891}
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Luoxuanqiang) [Orabug: 37976779] {CVE-2025-37912}
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976783] {CVE-2025-37913}
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976788] {CVE-2025-37914}
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira) [Orabug: 37970915] {CVE-2025-37890}
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976792] {CVE-2025-37915}
- pds_core: remove write-after-free of client_id (Shannon Nelson) [Orabug: 37976797] {CVE-2025-37916}
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud) [Orabug: 37976802] {CVE-2025-37917}
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu) [Orabug: 37976804] {CVE-2025-37918}
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu) [Orabug: 37976806] {CVE-2025-37919}
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (Eryk Kubanski) [Orabug: 37976809] {CVE-2025-37920}
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel) [Orabug: 37976815] {CVE-2025-37921}
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov) [Orabug: 37976734] {CVE-2025-37897}
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom) [Orabug: 37976819] {CVE-2025-37922}
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Sun Peng Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park) [Orabug: 37976821] {CVE-2025-37923}
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan) [Orabug: 37976738] {CVE-2025-37899}
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan) [Orabug: 37976828] {CVE-2025-37924}
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon) [Orabug: 37976832] {CVE-2025-37926}
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen) [Orabug: 37976741] {CVE-2025-37900}
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov) [Orabug: 37976836] {CVE-2025-37927}
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (Longping Wei) [Orabug: 37976844] {CVE-2025-37928}
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Xu Wang) [Orabug: 37977118] {CVE-2025-37990}
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold) [Orabug: 37976744] {CVE-2025-37901}
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson) [Orabug: 37976874] {CVE-2025-37936}
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller) [Orabug: 37977127] {CVE-2025-37991}
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon) [Orabug: 37977182] {CVE-2025-37929}
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner) [Orabug: 37976850] {CVE-2025-37930}
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik) [Orabug: 37976853] {CVE-2025-37931}
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya) [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil) [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert) [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter) [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King) [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche) [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert) [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar) [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang) [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli) [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre) [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta) [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon) [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon) [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth) [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth) [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick) [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli) [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval) [Orabug: 37930100] {CVE-2025-37821}
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang) [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed) [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan) [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.31.1.el10uek]" date="1748952000">- LTS version: v6.12.31 (Jack Vogel)
- drm/gem: Internally test import_attach for imported objects (Thomas Zimmermann)
- x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers (Balbir Singh)
- i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() (Nathan Chancellor)
- pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group() (Dan Carpenter)
- watchdog: aspeed: fix 64-bit division (Arnd Bergmann)
- drm/amdkfd: Correct F8_MODE for gfx950 (Amber Lin)
- serial: sh-sci: Save and restore more registers (Geert Uytterhoeven)
- bpf: abort verification if env-&gt;cur_state-&gt;loop_entry != NULL (Eduard Zingerman)
- drm/amd/display: Exit idle optimizations before accessing PHY (Ovidiu Bunea)
- kbuild: Properly disable -Wunterminated-string-initialization for clang (Nathan Chancellor)
- Fix mis-uses of 'cc-option' for warning disablement (Linus Torvalds)
- gcc-15: disable '-Wunterminated-string-initialization' entirely for now (Linus Torvalds)
- gcc-15: make 'unterminated string initialization' just a warning (Linus Torvalds)
- err.h: move IOMEM_ERR_PTR() to err.h (Raag Jadav)
- spi: spi-fsl-dspi: Reset SR flags before sending a new message (Larisa Grigore)
- spi: spi-fsl-dspi: Halt the module after a new message transfer (Bogdan-Gabriel Roman)
- spi: spi-fsl-dspi: restrict register range for regmap access (Larisa Grigore)
- spi: use container_of_cont() for to_spi_device() (Greg Kroah-Hartman)
- platform/x86: think-lmi: Fix attribute name usage for non-compliant items (Mark Pearson)
- ksmbd: fix stream write failure (Namjae Jeon)
- Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection" (Jernej Skrabec)
- Bluetooth: btmtksdio: Do close if SDIO card removed without close (Chris Lu)
- Bluetooth: btmtksdio: Check function enabled before doing close (Chris Lu)
- nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() (Ryusuke Konishi)
- mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled (Ignacio Moreno Gonzalez)
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Tianyang Zhang)
- memcg: always call cond_resched() after fn() (Breno Leitao)
- highmem: add folio_test_partial_kmap() (Matthew Wilcox)
- Input: xpad - add more controllers (Vicki Pfau)
- Revert "drm/amd: Keep display off while going into S4" (Mario Limonciello)
- smb: client: Reset all search buffer pointers when releasing buffer (Zhaolong Wang)
- arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (Gabor Juhos)
- smb: client: Fix use-after-free in cifs_fill_dirent (Zhaolong Wang) [Orabug: 38094970] {CVE-2025-38051}
- drm/edid: fixed the bug that hdr metadata was not reset (Feijuan Li)
- thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature (Zhang Rui)
- platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin) [Orabug: 38095141] {CVE-2025-38077}
- pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
- pmdomain: renesas: rcar: Remove obsolete nullify checks (Geert Uytterhoeven)
- vmxnet3: update MTU after device quiesce (Ronak Doshi)
- net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
- can: kvaser_pciefd: Fix echo_skb race (Axel Forsman)
- can: kvaser_pciefd: Continue parsing DMA buf after dropped RX (Axel Forsman)
- llc: fix data loss when reading from a socket in llc_ui_recvmsg() (Gavrilov Ilia)
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10 (Ed Burcher)
- ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [Orabug: 38095145] {CVE-2025-38078}
- ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction (Peter Ujfalusi)
- ASoc: SOF: topology: connect DAI to a single DAI link (Kai Vehmanen)
- ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext (Peter Ujfalusi)
- can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp) [Orabug: 38049369] {CVE-2025-38003}
- can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 38049374] {CVE-2025-38004}
- can: slcan: allow reception of short error messages (Carlos Sanchez)
- padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094842] {CVE-2025-38031}
- crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [Orabug: 38095153] {CVE-2025-38079}
- clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe() (André Draszik)
- octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG (Geetha Sowjanya)
- octeontx2-af: Set LMT_ENA bit for APR table entries (Subbaraya Sundeep)
- net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang) [Orabug: 38094978] {CVE-2025-38052}
- octeontx2-pf: Add AF_XDP non-zero copy support (Suman Ghosh)
- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [Orabug: 38049357] {CVE-2025-38000}
- idpf: fix idpf_vport_splitq_napi_poll() (Eric Dumazet)
- io_uring: fix overflow resched cqe reordering (Pavel Begunkov)
- net: lan743x: Restore SGMII CTRL register on resume (Thangaraj Samynathan)
- net: dwmac-sun8i: Use parsed internal PHY address instead of 1 (Paul Kocialkowski)
- pinctrl: qcom: switch to devm_register_sys_off_handler() (Dmitry Baryshkov)
- loop: don't require -&gt;write_iter for writable files in loop_configure (Christoph Hellwig)
- idpf: fix null-ptr-deref in idpf_features_check (Pavan Kumar Linga) [Orabug: 38094982] {CVE-2025-38053}
- ice: Fix LACP bonds without SRIOV environment (Dave Ertman)
- ice: fix vf-&gt;num_mac count with port representors (Jacob Keller)
- bridge: netfilter: Fix forwarding of fragmented packets (Ido Schimmel)
- ptp: ocp: Limit signal/freq counts in summary output functions (Sagi Maimon) [Orabug: 38094984] {CVE-2025-38054}
- Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling (En-Wei Wu)
- Bluetooth: L2CAP: Fix not checking l2cap_chan security level (Luiz Augusto von Dentz)
- perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter) [Orabug: 38094988] {CVE-2025-38055}
- irqchip/riscv-imsic: Start local sync timer on correct CPU (Andrew Bresticker)
- ASoC: SOF: Intel: hda: Fix UAF when reloading module (Tavian Barnes) [Orabug: 38094991] {CVE-2025-38056}
- devres: Introduce devm_kmemdup_array() (Raag Jadav)
- driver core: Split devres APIs to device/devres.h (Andy Shevchenko)
- dmaengine: fsl-edma: Fix return code for unhandled interrupts (Stefan Wahren)
- dmaengine: idxd: Fix -&gt;poll() return value (Dave Jiang)
- xfrm: Sanitize marks before insert (Paul Chaignon)
- clk: sunxi-ng: d1: Add missing divider for MMC mod clocks (Andre Przywara)
- remoteproc: qcom_wcnss: Fix on platforms without fallback regulators (Matti Lehtimäki)
- kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() (David Hildenbrand)
- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (Seongman Lee)
- dmaengine: idxd: Fix allowing write() from different address spaces (Vinicius Costa Gomes)
- xfrm: Fix UDP GRO handling for some corner cases (Tobias Brunner)
- espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca)
- espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094993] {CVE-2025-38057}
- soundwire: bus: Fix race on the creation of the IRQ domain (Charles Keepax)
- __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [Orabug: 38095000] {CVE-2025-38058}
- drm/amd/display: Call FP Protect Before Mode Programming/Mode Support (Austin Zheng)
- xenbus: Allow PVH dom0 a non-local xenstore (Jason Andryuk)
- x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust &gt;= 1.88 (Paweł Anikiel) [Orabug: 38094847] {CVE-2025-38033}
- wifi: iwlwifi: add support for Killer on MTL (Johannes Berg)
- block: only update request sector if needed (Johannes Thumshirn)
- tools: ynl-gen: validate 0 len strings from kernel (David Wei)
- btrfs: avoid NULL pointer dereference if no valid csum tree (Qu Wenruo) [Orabug: 38095010] {CVE-2025-38059}
- btrfs: handle empty eb-&gt;folios in num_extent_folios() (Boris Burkov)
- btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [Orabug: 38094856] {CVE-2025-38034}
- btrfs: compression: adjust cb-&gt;compressed_folios allocation type (Kees Cook)
- ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers (Stefan Binding)
- cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function (Pali Rohár)
- cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info() (Pali Rohár)
- io_uring/fdinfo: annotate racy sq/cq head/tail reads (Jens Axboe)
- nvmet-tcp: don't restore null sk_state_change (Alistair Francis) [Orabug: 38094863] {CVE-2025-38035}
- ALSA: usb-audio: Fix duplicated name in MIDI substream names (Takashi Iwai)
- nvme-pci: add quirks for WDC Blue SN550 15b7:5009 (Guan Wentao)
- nvme-pci: add quirks for device 126f:1001 (Guan Wentao)
- ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 (Takashi Iwai)
- ASoC: cs42l43: Disable headphone clamps during type detection (Charles Keepax)
- platform/x86: ideapad-laptop: add support for some new buttons (Gašper Nemgar)
- platform/x86: asus-wmi: Disable OOBE state after resume from hibernation (Pavel Nikulin)
- platform/x86/intel: hid: Add Pantherlake support (Saranya Gopal)
- smb: server: smb2pdu: check return value of xa_store() (Salah Triki)
- pinctrl: meson: define the pull up/down resistor value as 60 kOhm (Martin Blumenstingl)
- book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n (Ritesh Harjani)
- ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of() (Chenyuan Yang)
- drm: Add valid clones check (Jessica Zhang)
- drm/panel-edp: Add Starry 116KHD024006 (Douglas Anderson)
- drm/buddy: fix issue that force_merge cannot free all roots (Lin Cao)
- drm/atomic: clarify the rules around drm_atomic_state-&gt;allow_modeset (Simona Vetter)
- drm/xe: Reject BO eviction if BO is bound to current VM (Oak Zeng)
- drm/xe/sa: Always call drm_suballoc_manager_fini() (Michal Wajdeczko)
- wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event (Ching-Te Ku)
- drm/xe: Do not attempt to bootstrap VF in execlists mode (Maarten Lankhorst)
- drm/xe: Move suballocator init to after display init (Maarten Lankhorst)
- wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (P Praneesh)
- drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE (Zhi Wang)
- drm: bridge: adv7511: fill stream capabilities (Olivier Moysan)
- wifi: ath12k: Fix end offset bit definition in monitor ring descriptor (P Praneesh)
- wifi: ath12k: Fetch regdb.bin file from board-2.bin (Aaradhana Sahu)
- wifi: ath9k: return by of_get_mac_address (Rosen Penev)
- drm/xe/pf: Reset GuC VF config when unprovisioning critical resource (Michal Wajdeczko)
- accel/qaic: Mask out SR-IOV PCI resources (Youssef Samir)
- wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override (Nicolas Escande)
- regulator: ad5398: Add device tree support (Isaac Scott)
- spi: zynqmp-gqspi: Always acknowledge interrupts (Sean Anderson)
- wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet (Ping-Ke Shih)
- wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate (Bitterblue Smith)
- wifi: rtl8xxxu: retry firmware download on error (Soeren Moch)
- clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation (Lad Prabhakar)
- perf/amd/ibs: Fix -&gt;config to sample period calculation for OP PMU (Ravi Bangoria)
- perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (Ravi Bangoria)
- firmware: arm_scmi: Relax duplicate name constraint across protocol ids (Sudeep Holla)
- bpftool: Fix readlink usage in get_fd_type (Viktor Malik)
- bpf: Use kallsyms to find the function name of a struct_ops's stub function (Martin Kafai Lau)
- drm/ast: Find VBIOS mode from regular display size (Thomas Zimmermann)
- dm vdo: use a short static string for thread name prefix (Matthew Sakai)
- dm vdo indexer: prevent unterminated string warning (Chung Chung)
- irqchip/riscv-aplic: Add support for hart indexes (Vladimir Kondratiev)
- ASoC: rt722-sdca: Add some missing readable registers (Charles Keepax)
- ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode (Cezary Rojewski)
- arm64: zynqmp: add clock-output-names property in clock nodes (Naman Trivedi Manojbhai)
- HID: usbkbd: Fix the bit shift number for LED_KANA (Junan)
- wifi: ath12k: Avoid napi_sync() before napi_enable() (Avula Sri Charan)
- scsi: st: Restore some drive settings after reset (Kai Mäkisara)
- net/mana: fix warning in the writer of client oob (Konstantin Taranov)
- drm/xe/relay: Don't use GFP_KERNEL for new transactions (Michal Wajdeczko)
- ice: count combined queues using Rx/Tx count (Michal Swiatkowski)
- perf: Avoid the read if the count is already updated (Peter Zijlstra)
- rcu: fix header guard for rcu_all_qs() (Ankur Arora)
- rcu: handle unstable rdp in rcu_read_unlock_strict() (Ankur Arora)
- rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y (Ankur Arora)
- ice: treat dyn_allowed only as suggestion (Michal Swiatkowski)
- ice: init flow director before RDMA (Michal Swiatkowski)
- bridge: mdb: Allow replace of a host-joined group (Petr Machata)
- net: flush_backlog() small changes (Eric Dumazet)
- r8169: don't scan PHY addresses &gt; 0 (Heiner Kallweit)
- ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only (Geert Uytterhoeven)
- vxlan: Annotate FDB data races (Ido Schimmel) [Orabug: 38094879] {CVE-2025-38037}
- cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (Dhananjay Ugwekar) [Orabug: 38094888] {CVE-2025-38038}
- tools: ynl-gen: don't output external constants (Jakub Kicinski)
- eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs (Alexander Duyck)
- drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0 (Cristian Ciocaltea)
- media: qcom: camss: Add default case in vfe_src_pad_code (Depeng Shao)
- media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available (Depeng Shao)
- f2fs: introduce f2fs_base_attr for global sysfs entries (Jaegeuk Kim)
- hwmon: (xgene-hwmon) use appropriate type for the latency value (Andrey Vatoropin)
- tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options (Len Brown)
- net: page_pool: avoid false positive warning if NAPI was never added (Jakub Kicinski)
- clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs (Jordan Crouse)
- wifi: rtw89: call power_on ahead before selecting firmware (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before accessing (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before getting its size (Ping-Ke Shih)
- wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang (Ching-Te Ku)
- wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix download_firmware_validate() for RTL8814AU (Bitterblue Smith)
- ext4: remove writable userspace mappings before truncating page cache (Zhang Yi)
- ext4: don't write back data before punch hole in nojournal mode (Zhang Yi)
- leds: trigger: netdev: Configure LED blink interval for HW offload (Marek Vasut)
- pstore: Change kmsg_bytes storage size to u32 (Kees Cook)
- iio: adc: ad7944: don't use storagebits for sizing (David Lechner)
- r8152: add vendor/device ID pair for Dell Alienware AW1022z (Aleksander Jan Bajkowski)
- ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). (Kuniyuki Iwashima)
- arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src (Athira Rajeev)
- powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (Gaurav Batra)
- powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Gaurav Batra)
- net: fec: Refactor MAC reset to function (Csókás Bence)
- wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx (Emmanuel Grumbach)
- wifi: mac80211: remove misplaced drv_mgd_complete_tx() call (Johannes Berg)
- wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() (Johannes Berg)
- wifi: iwlwifi: don't warn during reprobe (Miri Korenblit)
- wifi: iwlwifi: use correct IMR dump variable (Johannes Berg)
- mptcp: pm: userspace: flags: clearer msg if no remote addr (Matthieu Baerts)
- wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV (P Praneesh)
- xfrm: prevent high SEQ input in non-ESN mode (Leon Romanovsky)
- drm/v3d: Add clock handling (Stefan Wahren)
- net/mlx5e: reduce the max log mpwrq sz for ECPF and reps (William Tu)
- net/mlx5e: reduce rep rxq depth to 256 for ECPF (William Tu)
- net/mlx5e: set the tx_queue_len for pfifo_fast (William Tu)
- net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB (Alexei Lazar)
- net/mlx5: XDP, Enable TX side XDP multi-buffer support (Alexei Lazar)
- scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr() (Chaohai Chen)
- drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer() (Alex Deucher)
- drm/amdgpu: enlarge the VBIOS binary size limit (Morris Zhang)
- drm/amdgpu: Use active umc info from discovery (Lijo Lazar)
- drm/amd/display: Populate register address for dentist for dcn401 (Dillon Varone)
- drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It (Austin Zheng)
- drm/amd/display: Increase block_sequence array size (Joshua Aberback) [Orabug: 38095164] {CVE-2025-38080}
- drm/amd/display: Initial psr_version with correct setting (Tom Chung)
- drm/amd/display: Update CR AUX RD interval interpretation (George Shen)
- Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY" (Brandon Syu)
- drm/amd/display: Support multiple options during psr entry. (Martin Tsai)
- drm/amd/pm: Skip P2S load for SMU v13.0.12 (Asad Kamal)
- drm/amdgpu: reset psp-&gt;cmd to NULL after releasing the buffer (Jiang Liu)
- drm/amd/display: Don't try AUX transactions on disconnected link (Ilya Bakoulin)
- drm/amd/display: pass calculated dram_speed_mts to dml2 (Charlene Liu)
- drm/amdgpu: Set snoop bit for SDMA for MI series (Harish Kasiviswanathan)
- drm/amdkfd: fix missing L2 cache info in topology (Eric Huang)
- drm/amdgpu/mes11: fix set_hw_resources_1 calculation (Alex Deucher)
- net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size (Huacai Chen)
- soundwire: cadence_master: set frame shape and divider based on actual clk freq (Bard Liao)
- soundwire: amd: change the soundwire wake enable/disable sequence (Vijendar Mukunda)
- phy: exynos5-usbdrd: fix EDS distribution tuning (gs101) (André Draszik)
- phy: core: don't require set_mode() callback for phy_get_mode() to work (Dmitry Baryshkov)
- phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF (Damon Ding)
- pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down (Claudiu Beznea)
- serial: sh-sci: Update the suspend/resume support (Claudiu Beznea)
- sched: Reduce the default slice to avoid tasks getting an extra tick (Zihan Zhou)
- x86/traps: Cleanup and robustify decode_bug() (Peter Zijlstra)
- x86/ibt: Handle FineIBT in handle_cfi_failure() (Peter Zijlstra)
- drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set (Shuicheng Lin)
- drm/xe/debugfs: fixed the return value of wedged_mode_set (Xin Wang)
- clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate (Krzysztof Kozlowski)
- clk: qcom: ipq5018: allow it to be bulid on arm32 (Karl Chan)
- drm/xe: Fix xe_tile_init_noalloc() error propagation (Lucas De Marchi)
- drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init() (Lucas De Marchi)
- net/mlx4_core: Avoid impossible mlx4_db_alloc() order value (Kees Cook)
- media: v4l: Memset argument to 0 before calling get_mbus_config pad op (Sakari Ailus)
- media: i2c: imx219: Correct the minimum vblanking value (David Plowman)
- kunit: tool: Use qboot on QEMU x86_64 (Brendan Jackman)
- smack: Revert "smackfs: Added check catlen" (Konstantin Andreev)
- smack: recognize ipv4 CIPSO w/o categories (Konstantin Andreev)
- pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map (Valentin Caron)
- ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() (Kuninori Morimoto)
- ASoC: tas2764: Power up/down amp on mute ops (Hector Martin)
- ASoC: tas2764: Mark SW_RESET as volatile (Hector Martin)
- ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG (Hector Martin)
- ASoC: ops: Enforce platform maximum on initial value (Martin Povišer)
- firmware: xilinx: Dont send linux address to get fpga config get status (Siva Durga Prasad Paladugu)
- firmware: arm_ffa: Handle the presence of host partition in the partition info (Sudeep Holla)
- firmware: arm_ffa: Reject higher major version as incompatible (Sudeep Holla)
- net/mlx5: Apply rate-limiting to high temperature warning (Shahar Shitrit)
- net/mlx5: Modify LSB bitmask in temperature event to include only the first bit (Shahar Shitrit)
- media: test-drivers: vivid: don't call schedule in loop (Hans Verkuil)
- irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base (Andrew Jones)
- hrtimers: Replace hrtimer_clock_to_base_table with switch-case (Andy Shevchenko)
- vxlan: Join / leave MC group after remote changes (Petr Machata)
- ACPI: HED: Always initialize before evged (Xiaofei Tan)
- PCI: Fix old_size lower bound in calculate_iosize() too (Ilpo Järvinen)
- eth: mlx4: don't try to complete XDP frames in netpoll (Jakub Kicinski)
- bpf: copy_verifier_state() should copy 'loop_entry' field (Eduard Zingerman) [Orabug: 38095018] {CVE-2025-38060}
- bpf: don't do clean_live_states when state-&gt;loop_entry-&gt;branches &gt; 0 (Eduard Zingerman)
- can: c_can: Use of_property_present() to test existence of DT property (Krzysztof Kozlowski)
- pmdomain: imx: gpcv2: use proper helper for property detection (Ahmad Fatoum)
- RDMA/core: Fix best page size finding when it can cross SG entries (Michael Margolin)
- serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (Alexis Lothoré) [Orabug: 38094901] {CVE-2025-38040}
- drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink (Harry Wentland)
- Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP" (Leo Zeng)
- drm/amd/display: Read LTTPR ALPM caps during link cap retrieval (George Shen)
- drm/amd/display: Fix BT2020 YCbCr limited/full range input (Ilya Bakoulin)
- drm/amd/display: Guard against setting dispclk low when active (Nicholas Kazlauskas)
- drm/amd/display: Add support for disconnected eDP streams (Harry Vanzylldejong)
- drm/amd/pm: Fetch current power limit from PMFW (Lijo Lazar)
- irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector (Anup Patel)
- eeprom: ee1004: Check chip before probing (Eddie James)
- mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs (Chris Morgan)
- i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA) (Frank Li)
- EDAC/ie31200: work around false positive build warning (Arnd Bergmann)
- power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree (Chris Morgan)
- net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [Orabug: 38095024] {CVE-2025-38061}
- wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU (Kuan-Chung Chen)
- wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware (Ping-Ke Shih)
- wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32() (Ping-Ke Shih)
- wifi: rtw89: fw: propagate error code from rtw89_h2c_tx() (Ping-Ke Shih)
- wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU (Bitterblue Smith)
- PCI: epf-mhi: Update device ID for SA8775P (Mrinmay Sarkar)
- clocksource: mips-gic-timer: Enable counter when CPUs start (Paul Burton)
- MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core (Paul Burton)
- genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (Jason Gunthorpe) [Orabug: 38095031] {CVE-2025-38062}
- x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op() (Uros Bizjak)
- drm/amdgpu: remove all KFD fences from the BO on release (Christian König)
- MIPS: Use arch specific syscall name match function (Bibo Mao)
- drm/xe/oa: Ensure that polled read returns latest data (Umesh Nerlige Ramappa)
- net: ipv6: Init tunnel link-netns before registering dev (Xiao Liang)
- crypto: skcipher - Zap type in crypto_alloc_sync_skcipher (Herbert Xu)
- crypto: ahash - Set default reqsize from ahash_alg (Herbert Xu)
- x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh)
- net/mlx5: Change POOL_NEXT_SIZE define value and make it global (Patrisious Haddad)
- scsi: scsi_debug: First fixes for tapes (Kai Mäkisara)
- dm: fix unconditional IO throttle caused by REQ_PREFLUSH (Jinliang Zheng) [Orabug: 38095038] {CVE-2025-38063}
- libbpf: Fix out-of-bound read (Nandakumar Edamana)
- loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize (Christoph Hellwig)
- net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode (Jianbo Liu)
- media: tc358746: improve calculation of the D-PHY timing registers (Matthias Fend)
- media: adv7180: Disable test-pattern control on adv7180 (Niklas Söderlund)
- cpuidle: menu: Avoid discarding useful information (Rafael J. Wysocki)
- vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines (Konstantin Shkolnyy)
- x86/nmi: Add an emergency handler in nmi_desc &amp; use it in nmi_shootdown_cpus() (Waiman Long)
- ASoC: mediatek: mt8188: Add reference for dmic clocks (Nícolas F R A Prado)
- ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile (Nícolas F R A Prado)
- drm/amd/display: Fix mismatch type comparison (Navid Assadian)
- drm/amd/display: fix dcn4x init failed (Charlene Liu)
- drm/amd/display: handle max_downscale_src_width fail check (Yihan Zhu)
- x86/build: Fix broken copy command in genimage.sh when making isoimage (Nir Lichtman)
- Octeontx2-af: RPM: Register driver with PCI subsys IDs (Hariprasad Kelam)
- bpf: Search and add kfuncs in struct_ops prologue and epilogue (Amery Hung)
- soc: ti: k3-socinfo: Do not use syscon helper to build regmap (Andrew Davis)
- wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band (Ramasamy Kaliappan)
- bonding: report duplicate MAC address in all situations (Hangbin Liu)
- net: xgene-v2: remove incorrect ACPI_PTR annotation (Arnd Bergmann)
- net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only (Eric Woudstra)
- leds: pwm-multicolor: Add check for fwnode_property_read_u32 (Yuanjun Gong)
- drm/xe: xe_gen_wa_oob: replace program_invocation_short_name (Daniel Gomez)
- drm/amdkfd: KFD release_work possible circular locking (Philip Yang)
- pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf (Inochi Amaoto)
- selftests/net: have `gro.sh -t` return a correct exit code (Kevin Krakauer)
- net/mlx5: Avoid report two health errors on same syndrome (Moshe Shemesh)
- drm/xe/pf: Create a link between PF and VF devices (K V P Satyanarayana)
- drm/xe/vf: Retry sending MMIO request to GUC on timeout error (K V P Satyanarayana)
- firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar) [Orabug: 38094925] {CVE-2025-38043}
- PCI: brcmstb: Add a softdep to MIP MSI-X driver (Stanimir Varbanov)
- PCI: brcmstb: Expand inbound window size up to 64GB (Stanimir Varbanov)
- wifi: ath12k: Report proper tx completion status to mac80211 (Vinith Kumar R)
- soc: apple: rtkit: Implement OSLog buffers properly (Hector Martin)
- soc: apple: rtkit: Use high prio work queue (Janne Grunau)
- perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters (Rob Herring)
- fpga: altera-cvp: Increase credit timeout (Kuhanh Murugasen Krishnan)
- drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence (AngeloGioacchino Del Regno)
- ARM: at91: pm: fix at91_suspend_finish for ZQ calibration (Li Bin)
- hwmon: (gpio-fan) Add missing mutex locks (Alexander Stein)
- x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Breno Leitao)
- clk: imx8mp: inform CCF of maximum frequency of clocks (Ahmad Fatoum)
- media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value (Ricardo Ribalda)
- media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map (Ricardo Ribalda)
- ublk: complete command synchronously on error (Caleb Sander)
- block: mark bounce buffering as incompatible with integrity (Christoph Hellwig)
- drm/rockchip: vop2: Add uv swap for cluster window (Andy Yan)
- ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). (Kuniyuki Iwashima)
- scsi: logging: Fix scsi_logging_level bounds (Nicolas Bouchinet)
- ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7 (Maciej S. Szmigiero)
- perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (Saket Kumar Bhaskar)
- net: pktgen: fix mpls maximum labels list parsing (Peter Seiderer)
- media: imx335: Set vblank immediately (Paul Elder)
- iommufd: Disallow allocating nested parent domain with fault ID (Yi Liu)
- ublk: enforce ublks_max only for unprivileged devices (Uday Shankar)
- dpll: Add an assertion to check freq_supported_num (Jiasheng Jiang)
- net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104 (Andrei Botila)
- net: ethernet: ti: cpsw_new: populate netdev of_node (Alexander Sverdlin)
- rcu: Fix get_state_synchronize_rcu_full() GP-start detection (Paul E. McKenney)
- pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" (Artur Weber)
- media: cx231xx: set device_caps for 417 (Hans Verkuil) [Orabug: 38094934] {CVE-2025-38044}
- perf/core: Clean up perf_try_init_event() (Peter Zijlstra)
- drm/amd/display: Request HW cursor on DCN3.2 with SubVP (Aric Cyr)
- drm/amd/display: Fix p-state type when p-state is unsupported (Dillon Varone)
- drm/amd/display: Fix DMUB reset sequence for DCN401 (Dillon Varone)
- drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination (George Shen)
- drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35 (Nicholas Kazlauskas)
- drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c (Victor Lu)
- remoteproc: qcom_wcnss: Handle platforms with only single power domain (Matti Lehtimäki)
- blk-throttle: don't take carryover for prioritized processing of metadata (Ming Lei)
- net: phylink: use pl-&gt;link_interface in phylink_expects_phy() (Choong Yong Liang)
- drm/gem: Test for imported GEM buffers with helper (Thomas Zimmermann)
- orangefs: Do not truncate file size (Matthew Wilcox) [Orabug: 38095056] {CVE-2025-38065}
- soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables (AngeloGioacchino Del Regno)
- dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [Orabug: 38095063] {CVE-2025-38066}
- usb: xhci: set page size to the xHCI-supported size (Niklas Neronin)
- media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() (Markus Elfring)
- ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 (Svyatoslav Ryhel)
- soc: samsung: include linux/array_size.h where needed (Arnd Bergmann)
- drm/xe: Retry BO allocation (Matthew Brost)
- drm/xe: Nuke VM's mapping upon close (Matthew Brost)
- ieee802154: ca8210: Use proper setters and getters for bitwise types (Andy Shevchenko)
- rtc: ds1307: stop disabling alarms on probe (Alexandre Belloni)
- tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() (Eric Dumazet)
- ALSA: seq: Improve data consistency at polling (Takashi Iwai)
- powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 (Andreas Schwab)
- arm64: tegra: Resize aperture for the IGX PCIe C5 slot (Jonathan Hunter)
- arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator (Diogo Ivo)
- drm/amdgpu: Fix missing drain retry fault the last entry (Emily Deng)
- drm/amdkfd: Set per-process flags only once cik/vi (Harish Kasiviswanathan)
- drm/amdkfd: Set per-process flags only once for gfx9/10/11/12 (Harish Kasiviswanathan)
- crypto: mxs-dcp - Only set OTP_KEY bit for OTP key (Sven Schwermer)
- crypto: lzo - Fix compression buffer overrun (Herbert Xu) [Orabug: 38095079] {CVE-2025-38068}
- misc: pci_endpoint_test: Give disabled BARs a distinct error code (Niklas Cassel)
- PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops (Christian Bruel) [Orabug: 38095087] {CVE-2025-38069}
- watchdog: aspeed: Update bootstatus handling (Chin-Ting Kuo)
- cpufreq: tegra186: Share policy per cluster (Aaron Kling)
- iommu/amd/pgtbl_v2: Improve error handling (Vasant Hegde)
- coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t (Levi Yun)
- badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable &lt; 0 (Coly Li)
- ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup() (Alexey Klimov)
- auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" (Andy Shevchenko)
- gfs2: Check for empty queue in run_queue (Andreas Gruenbacher)
- drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch (Leon Huang)
- drm/amd/display: not abort link train when bw is low (Peichen Huang)
- drm/amd/display: calculate the remain segments for all pipes (Zhikai Zhai)
- drm/amd/display: remove minimum Dispclk and apply oem panel timing. (Charlene Liu)
- ipv6: save dontfrag in cork (Willem de Bruijn)
- wifi: cfg80211: allow IR in 20 MHz configurations (Anjaneyulu)
- wifi: mac80211_hwsim: Fix MLD address translation (Ilan Peer)
- wifi: mac80211: fix warning on disconnect during failed ML reconf (Johannes Berg)
- wifi: iwlwifi: fix the ECKV UEFI variable name (Emmanuel Grumbach)
- wifi: iwlwifi: mark Br device not integrated (Johannes Berg)
- wifi: iwlwifi: fix debug actions order (Johannes Berg) [Orabug: 38094942] {CVE-2025-38045}
- wifi: iwlwifi: w/a FW SMPS mode selection (Daniel Gabay)
- wifi: iwlwifi: don't warn when if there is a FW error (Miri Korenblit)
- printk: Check CON_SUSPEND when unblanking a console (Marcos Paulo de Souza)
- iommu: Keep dev-&gt;iommu state consistent (Robin Murphy)
- hwmon: (dell-smm) Increment the number of fans (Kurt Borja)
- wifi: iwlwifi: mvm: fix setting the TK when associated (Avraham Stern)
- usb: xhci: Don't change the status of stalled TDs on failed Stop EP (Michał Pecio)
- mmc: sdhci: Disable SD card clock before changing parameters (Erick Shepherd)
- mmc: dw_mmc: add exynos7870 DW MMC support (Kaustabh Chakraborty)
- arm64/mm: Check PUD_TYPE_TABLE in pud_bad() (Ryan Roberts)
- arm64/mm: Check pmd_table() in pmd_trans_huge() (Ryan Roberts)
- phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set (Andy Yan)
- PNP: Expand length of fixup id string (Kees Cook)
- netfilter: conntrack: Bound nf_conntrack sysctl writes (Nicolas Bouchinet)
- wifi: rtw89: set force HE TB mode when connecting to 11ax AP (Dian-Syuan Yang)
- timer_list: Don't use %pK through printk() (Thomas Weißschuh)
- net: hsr: Fix PRP duplicate detection (Jaakko Karrenpalo)
- net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe (Jonas Karlman)
- posix-timers: Ensure that timer initialization is fully visible (Thomas Gleixner)
- posix-timers: Add cond_resched() to posix_timer_add() search loop (Eric Dumazet)
- RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() (Maher Sanalla)
- ext4: do not convert the unwritten extents if data writeback fails (Baokun Li)
- ext4: reject the 'data_err=abort' option in nojournal mode (Baokun Li)
- clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490 (Taniya Das)
- ASoC: sun4i-codec: support hp-det-gpios property (Ryan Walklin)
- drm/amdgpu: Update SRIOV video codec caps (David Rosca)
- drm/amdgpu/gfx11: don't read registers in mqd init (Alex Deucher)
- drm/amdgpu/gfx12: don't read registers in mqd init (Alex Deucher)
- mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check (Shree Ramamoorthy)
- pinctrl-tegra: Restore SFSEL bit when freeing pins (Prathamesh Shete)
- xen: Add support for XenServer 6.1 platform device (Frediano Ziglio)
- net/smc: use the correct ndev to find pnetid by pnetid table (Guangguan Wang)
- dm: restrict dm device size to 2^63-512 bytes (Mikulas Patocka)
- crypto: octeontx2 - suppress auth failure screaming due to negative tests (Shashank Gupta)
- kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf (Masahiro Yamada)
- kbuild: fix argument parsing in scripts/config (Seyediman Seyedarab)
- bpf: Allow pre-ordering for bpf cgroup progs (Yonghong Song)
- ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect (Nícolas F R A Prado)
- ASoC: pcm6240: Drop bogus code handling IRQ as GPIO (Linus Walleij)
- spi: spi-mux: Fix coverity issue, unchecked return value (Sergio Perez Gonzalez)
- erofs: initialize decompression early (Gao Xiang)
- thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer (Mika Westerberg)
- objtool: Fix error handling inconsistencies in check() (Josh Poimboeuf)
- rtc: rv3032: fix EERD location (Alexandre Belloni)
- tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() (Ilpo Järvinen)
- jbd2: do not try to recover wiped journal (Jan Kara)
- PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off() (Frank Li)
- bpf: Return prog btf_id without capable check (Mykyta Yatsenko)
- vfio/pci: Handle INTx IRQ_NOTCONNECTED (Alex Williamson)
- scsi: st: ERASE does not change tape location (Kai Mäkisara)
- scsi: st: Tighten the page format heuristics with MODE SELECT (Kai Mäkisara)
- hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure (Al Viro)
- ext4: reorder capability check last (Christian Göttsche)
- riscv: Call secondary mmu notifier when flushing the tlb (Alexandre Ghiti)
- bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set (Shantiprasad Shettar)
- wifi: mwifiex: Fix HT40 bandwidth issue. (Jeff Chen)
- um: Update min_low_pfn to match changes in uml_reserved (Tiwei Bie)
- um: Store full CSGSFS and SS register from mcontext (Benjamin Berg)
- clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug (Nick Hu)
- dlm: make tcp still work in multi-link env (Heming Zhao)
- s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste() (Heiko Carstens)
- i3c: master: svc: Fix missing STOP for master request (Stanley Chu)
- drm/amdgpu: adjust drm_firmware_drivers_only() handling (Alex Deucher)
- drm/amd/display: Guard against setting dispclk low for dcn31x (Jing Zhou)
- drm/amdgpu: release xcp_mgr on exit (Flora Cui)
- blk-cgroup: improve policy registration error handling (Chen Linxuan)
- btrfs: send: return -ENAMETOOLONG when attempting a path that is too long (Filipe Manana)
- btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work() (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to async workers (Filipe Manana)
- btrfs: run btrfs_error_commit_super() early (Qu Wenruo)
- btrfs: avoid linker error in btrfs_find_create_tree_block() (Mark Harmstone)
- btrfs: make btrfs_discard_workfn() block_group ref explicit (Boris Burkov)
- i2c: pxa: fix call balance of i2c-&gt;clk handling routines (Vitalii Mordan)
- i2c: qup: Vote for interconnect bandwidth to DRAM (Stephan Gerhold)
- x86/mm: Check return value from memblock_phys_alloc_range() (Philip Redkin) [Orabug: 38095101] {CVE-2025-38071}
- x86/microcode: Update the Intel processor flag scan check (Sohil Mehta)
- x86/smpboot: Fix INIT delay assignment for extended Intel Families (Sohil Mehta)
- x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP (Ingo Molnar)
- x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers (Thomas Huth)
- wifi: mt76: mt7925: fix fails to enter low power mode in suspend state (Quan Zhou)
- wifi: mt76: mt7925: load the appropriate CLC data based on hardware type (Ming Yen Hsieh)
- wifi: mt76: mt7996: revise TXS size (Benjamin Lin)
- wifi: mt76: mt7996: fix SER reset trigger on WED reset (Rex Lu)
- wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 (Felix Fietkau)
- cgroup/rstat: avoid disabling irqs for O(num_cpu) (Eric Dumazet)
- drm/amdgpu: Skip pcie_replay_count sysfs creation for VF (Victor Skvortsov)
- mmc: host: Wait for Vdd to settle on card power off (Erick Shepherd)
- staging: vchiq_arm: Create keep-alive thread during probe (Stefan Wahren)
- pidfs: improve multi-threaded exec and premature thread-group leader exit polling (Christian Brauner)
- libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [Orabug: 38095109] {CVE-2025-38072}
- ext4: on a remount, only log the ro or r/w state when it has changed (Nicolas Bretz)
- xen/pci: Do not register devices with segments &gt;= 0x10000 (Roger Pau Monné)
- PCI: vmd: Disable MSI remapping bypass under Xen (Roger Pau Monné)
- drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12 (Jonathan Kim)
- drm/amdgpu/discovery: check ip_discovery fw file available (Flora Cui)
- pNFS/flexfiles: Report ENETDOWN as a connection error (Trond Myklebust)
- tools/build: Don't pass test log files to linker (Ian Rogers)
- r8169: disable RTL8126 ZRX-DC timeout (Chunhao Lin)
- PCI: dwc: ep: Ensure proper iteration over outbound map windows (Frank Li)
- objtool: Properly disable uaccess validation (Josh Poimboeuf)
- lockdep: Fix wait context check on softirq for PREEMPT_RT (Ryo Takakura)
- dql: Fix dql-&gt;limit value when reset. (Jing Su)
- Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken (Pedro Nishiyama)
- Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal (Sean Wang)
- thermal/drivers/qoriq: Power down TMU on system suspend (Alice Guo)
- thermal/drivers/mediatek/lvts: Start sensor interrupts disabled (Nícolas F R A Prado)
- net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus (Hans-Frieder Vogt)
- net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards (Hans-Frieder Vogt)
- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (Daniel Hsu)
- ASoC: codecs: wsa883x: Correct VI sense channel mask (Krzysztof Kozlowski)
- ASoC: codecs: wsa884x: Correct VI sense channel mask (Krzysztof Kozlowski)
- spi-rockchip: Fix register out of bounds access (Luis de Arquer) [Orabug: 38095173] {CVE-2025-38081}
- SUNRPC: rpcbind should never reset the port to the value '0' (Trond Myklebust)
- SUNRPC: rpc_clnt_set_transport() must not change the autobind setting (Trond Myklebust)
- NFSv4: Treat ENETUNREACH errors as fatal for state recovery (Trond Myklebust)
- cifs: Fix establishing NetBIOS session for SMB2+ connection (Pali Rohár)
- cifs: add validation check for the fields in smb_aces (Namjae Jeon)
- cifs: Set default Netbios RFC1001 server name to hostname in UNC (Pali Rohár)
- fbdev: core: tileblit: Implement missing margin clearing for tileblit (Zsolt Kajtar)
- fbcon: Use correct erase colour for clearing in fbcon (Zsolt Kajtar)
- fbdev: fsl-diu-fb: add missing device_remove_file() (Shixiong Ou)
- riscv: Allow NOMMU kernels to access all of RAM (Samuel Holland)
- mailbox: use error ret code of of_parse_phandle_with_args() (Tudor Ambarus)
- mailbox: pcc: Use acpi_os_ioremap() instead of ioremap() (Sudeep Holla)
- tpm: Convert warn to dbg in tpm2_start_auth_session() (Jonathan Mcdowell)
- ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list (Diogo Ivo)
- tracing: Mark binary printing functions with __printf() attribute (Andy Shevchenko)
- iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability (Yi Liu)
- arm64: Add support for HIP09 Spectre-BHB mitigation (Jinqian Yang)
- SUNRPC: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFS: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Trond Myklebust)
- io_uring/msg: initialise msg request opcode (Pavel Begunkov)
- exfat: call bh_read in get_block only when necessary (Sungjong Seo)
- fuse: Return EPERM rather than ENOSYS from link() (Matt Johnston)
- smb: client: Store original IO parameters and prevent zero IO sizes (Zhaolong Wang)
- cifs: Fix negotiate retry functionality (Pali Rohár)
- cifs: Fix querying and creating MF symlinks over SMB1 (Pali Rohár)
- cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES (Pali Rohár)
- s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log (Tony Krowiak)
- x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li) [Orabug: 38094951] {CVE-2025-38047}
- kconfig: merge_config: use an empty file as initfile (Daniel Gomez)
- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (Haoran Jiang)
- bpf: fix possible endless loop in BPF map iteration (Brandon Kammerdiener)
- io_uring: don't duplicate flushing in io_req_post_cqe (Pavel Begunkov)
- block: fix race between set_blocksize and read paths (Darrick J. Wong) [Orabug: 38095117] {CVE-2025-38073}
- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (Ihor Solodrai)
- drm/amdgpu: Allow P2P access through XGMI (Felix Kuehling)
- drm/amd/display: Enable urgent latency adjustment on DCN35 (Nicholas Susanto)
- fs/ext4: use sleeping version of sb_find_get_block() (Davidlohr Bueso)
- fs/jbd2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/ocfs2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: introduce sleeping flavors for pagecache lookups (Davidlohr Bueso)
- fs/buffer: split locking for pagecache lookups (Davidlohr Bueso)
- ima: process_measurement() needlessly takes inode_lock() on MAY_READ (Frederick Lawler)
- dma-mapping: Fix warning reported for missing prototype (Balbir Singh)
- net: enetc: refactor bulk flipping of RX buffers to separate function (Vladimir Oltean)
- vhost_task: fix vhost_task_create() documentation (Stefano Garzarella)
- cgroup: Fix compilation issue due to cgroup_mutex not being exported (Gao Xu)
- dma-mapping: avoid potential unused data compilation warning (Marek Szyprowski)
- mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type (Hans de Goede)
- intel_th: avoid using deprecated page-&gt;mapping, index fields (Lorenzo Stoakes)
- dma/mapping.c: dev_dbg support for dma_addressing_limited (Balbir Singh)
- virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han) [Orabug: 38094958] {CVE-2025-38048}
- scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices (Manish Pandey)
- scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [Orabug: 38095134] {CVE-2025-38075}
- nvmem: qfprom: switch to 4-byte aligned reads (Dmitry Baryshkov)
- nvmem: core: update raw_len if the bit reading is required (Dmitry Baryshkov)
- nvmem: core: verify cell's raw_len (Dmitry Baryshkov)
- nvmem: core: fix bit offsets of more than one byte (Dmitry Baryshkov)
- nvmem: rockchip-otp: add rk3576 variant data (Heiko Stuebner)
- nvmem: rockchip-otp: Move read-offset into variant-data (Heiko Stuebner)
- cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist (Pengyu Luo)
- phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Move IRQ request in probe (Claudiu Beznea)
- i2c: designware: Fix an error handling path in i2c_dw_pci_probe() (Christophe Jaillet)
- i2c: designware: Use temporary variable for struct device (Andy Shevchenko)
- drm/amd/display: Defer BW-optimization-blocked DRR adjustments (John Olender)
- drm/amd/display: Correct timing_adjust_pending flag setting. (Zhongwei)
- drm/amd/display: Do not enable replay when vtotal update is pending. (Sung-Huai Wang)
- drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401 (Dillon Varone)
- LTS version: v6.12.30 (Jack Vogel)
- drm/amdgpu: fix pm notifier handling (Alex Deucher)
- phy: tegra: xusb: remove a stray unlock (Dan Carpenter)
- usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977018] {CVE-2025-37967}
- drm/tiny: panel-mipi-dbi: Use drm_client_setup_with_fourcc() (Fabio Estevam)
- drm/panel-mipi-dbi: Run DRM default client setup (Thomas Zimmermann)
- drm/fbdev-dma: Support struct drm_driver.fbdev_probe (Thomas Zimmermann)
- Bluetooth: btnxpuart: Fix kernel panic during FW release (Neeraj Sanjay Kale) [Orabug: 37844459] {CVE-2025-22102}
- iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977026] {CVE-2025-37968}
- accel/ivpu: Fix fw log printing (Jacek Lawrynowicz)
- accel/ivpu: Refactor functions in ivpu_fw_log.c (Jacek Lawrynowicz)
- accel/ivpu: Reset fw log on cold boot (Tomasz Rusinowicz)
- accel/ivpu: Rename ivpu_log_level to fw_log_level (Jacek Lawrynowicz)
- mm/page_alloc: fix race condition in unaccepted memory handling (Kirill A. Shutemov) [Orabug: 38094767] {CVE-2025-38008}
- drm/xe/gsc: do not flush the GSC worker from the reset path (Daniele Ceraolo Spurio)
- CIFS: New mount option for cifs.upcall namespace resolution (Ritvik Budhiraja)
- dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (Shuai Xue) [Orabug: 38094790] {CVE-2025-38014}
- dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094793] {CVE-2025-38015}
- dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call (Shuai Xue)
- dmaengine: idxd: Add missing cleanups in cleanup internals (Shuai Xue)
- dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs (Shuai Xue)
- dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy (Yemike Abhilash Chandra)
- dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094756] {CVE-2025-38005}
- mm: userfaultfd: correct dirty flags set for both present and swap pte (Barry Song)
- net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
- ring-buffer: Fix persistent buffer when commit page is the reader page (Steven Rostedt)
- wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094770] {CVE-2025-38009}
- tpm: Mask TPM RC in tpm2_start_auth_session() (Jarkko Sakkinen)
- spi: tegra114: Use value to check for invalid delays (Aaron Kling)
- smb: client: fix memory leak during error handling for POSIX mkdir (Jethro Donaldson)
- scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer (Steve Siwinski)
- phy: renesas: rcar-gen3-usb2: Set timing registers only once (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind (Claudiu Beznea)
- phy: Fix error handling in tegra_xusb_port_init (Ma Ke)
- phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking (Wayne Chang) [Orabug: 38094777] {CVE-2025-38010}
- tracing: samples: Initialize trace_array_printk() with the correct function (Steven Rostedt)
- ftrace: Fix preemption accounting for stacktrace filter command (Donglin Peng)
- ftrace: Fix preemption accounting for stacktrace trigger command (Donglin Peng)
- kbuild: Disable -Wdefault-const-init-unsafe (Nathan Chancellor)
- Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer() (Michael Kelley)
- Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (Michael Kelley)
- arm64: dts: rockchip: Remove overdrive-mode OPPs from RK3588J SoC dtsi (Dragan Simic)
- arm64: dts: amlogic: dreambox: fix missing clkc_audio node (Christian Hewitt)
- hv_netvsc: Remove rmsg_pgcnt (Michael Kelley)
- hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (Michael Kelley)
- hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (Michael Kelley)
- dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi)
- ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera (Nicolas Chauvet)
- ALSA: usb-audio: Add sample rate quirk for Audioengine D1 (Christian Heusel)
- ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() (Xu Wang)
- ACPI: PPTT: Fix processor subtable walk (Jeremy Linton)
- gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
- MAINTAINERS: Update Alexey Makhalov's email address (Alexey Makhalov)
- drm/amd/display: Avoid flooding unnecessary info messages (Wayne Lin)
- drm/amd/display: Correct the reply value when AUX write incomplete (Wayne Lin)
- drm/amdgpu: csa unmap use uninterruptible lock (Philip Yang) [Orabug: 38094779] {CVE-2025-38011}
- drm/amdgpu: fix incorrect MALL size for GFX1151 (Tim Huang)
- Revert "drm/amd/display: Hardware cursor changes color when switched to software cursor" (Melissa Wen)
- btrfs: add back warning for mount option commit values exceeding 300 (Kyoji Ogasawara)
- btrfs: fix folio leak in submit_one_async_extent() (Boris Burkov)
- btrfs: fix discard worker infinite loop after disabling discard (Filipe Manana)
- LoongArch: uprobes: Remove redundant code about resume_era (Tiezhu Yang)
- LoongArch: uprobes: Remove user_{en,dis}able_single_step() (Tiezhu Yang)
- LoongArch: Fix MAX_REG_OFFSET calculation (Huacai Chen)
- LoongArch: Save and restore CSR.CNTC for hibernation (Huacai Chen)
- LoongArch: Move __arch_cpu_idle() to .cpuidle.text section (Huacai Chen)
- LoongArch: Prevent cond_resched() occurring within kernel-fpu (Tianyang Zhang)
- HID: bpf: abort dispatch if device destroyed (Rongrong) [Orabug: 38094796] {CVE-2025-38016}
- udf: Make sure i_lenExtents is uptodate on inode eviction (Jan Kara)
- sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator (Tejun Heo) [Orabug: 38094786] {CVE-2025-38012}
- dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" (Nathan Lynch)
- NFSv4/pnfs: Reset the layout state after a layoutreturn (Trond Myklebust)
- tsnep: fix timestamping with a stacked DSA driver (Gerhard Engleder)
- net/tls: fix kernel panic when alloc_page failed (Pengtao He) [Orabug: 38094802] {CVE-2025-38018}
- mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (Ido Schimmel) [Orabug: 38094804] {CVE-2025-38019}
- wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request (Kees Cook) [Orabug: 38094788] {CVE-2025-38013}
- octeontx2-pf: Do not reallocate all ntuple filters (Subbaraya Sundeep)
- octeontx2-af: Fix CGX Receive counters (Hariprasad Kelam)
- net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability (Bc-Bocun Chen)
- octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy (Subbaraya Sundeep)
- netlink: specs: tc: all actions are indexed arrays (Jakub Kicinski)
- netlink: specs: tc: fix a couple of attribute names (Jakub Kicinski)
- drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value (Umesh Nerlige Ramappa)
- regulator: max20086: fix invalid memory access (Cosmin Tanislav) [Orabug: 38094833] {CVE-2025-38027}
- qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() (Abdun Nihaal)
- net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094808] {CVE-2025-38020}
- vsock/test: Fix occasional failure in SIOCOUTQ tests (Konstantin Shkolnyy)
- net: dsa: b53: prevent standalone from trying to forward to other ports (Jonas Gorski)
- ALSA: sh: SND_AICA should depend on SH_DMA_API (Geert Uytterhoeven)
- nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (Keith Busch)
- nvme-pci: make nvme_pci_npages_prp() __always_inline (Kees Cook)
- net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING (Vladimir Oltean)
- net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe)
- ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info (Takashi Iwai)
- ALSA: seq: Fix delivery of UMP events to group ports (Takashi Iwai)
- net: mctp: Ensure keys maintain only one ref to corresponding dev (Andrew Jeffery)
- tests/ncdevmem: Fix double-free of queue array (Cosmin Ratiu)
- selftests: ncdevmem: Switch to AF_INET6 (Stanislav Fomichev)
- selftests: ncdevmem: Make client_ip optional (Stanislav Fomichev)
- selftests: ncdevmem: Unify error handling (Stanislav Fomichev)
- selftests: ncdevmem: Separate out dmabuf provider (Stanislav Fomichev)
- selftests: ncdevmem: Redirect all non-payload output to stderr (Stanislav Fomichev)
- net: mctp: Don't access ifa_index when missing (Matt Johnston)
- mctp: no longer rely on net-&gt;dev_index_head[] (Eric Dumazet)
- tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing (Hangbin Liu)
- net_sched: Flush gso_skb list too during -&gt;change() (Cong Wang) [Orabug: 37998128] {CVE-2025-37992}
- Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags (Luiz Augusto von Dentz)
- RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Zhu Yanjun) [Orabug: 38094813] {CVE-2025-38022}
- spi: loopback-test: Do not split 1024-byte hexdumps (Geert Uytterhoeven)
- nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094818] {CVE-2025-38023}
- HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 38094764] {CVE-2025-38007}
- HID: thrustmaster: fix memory leak in thrustmaster_interrupts() (Qasim Ijaz)
- RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094827] {CVE-2025-38024}
- virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx (Koichiro Den)
- virtio_ring: add a func argument 'recycle_done' to virtqueue_reset() (Koichiro Den)
- iio: chemical: sps30: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7768-1: Fix insufficient alignment of timestamp. (Jonathan Cameron)
- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
- xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
- Revert "drm/amd: Stop evicting resources on APUs in suspend" (Alex Deucher)
- drm/amd: Add Suspend/Hibernate notification callback support (Mario Limonciello)
- iio: pressure: mprls0025pa: use aligned_s64 for timestamp (David Lechner)
- iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7266: Fix potential timestamp alignment issue. (Jonathan Cameron)
- KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (Sean Christopherson)
- KVM: Add member to struct kvm_gfn_range to indicate private/shared (Isaku Yamahata)
- uio_hv_generic: Fix sysfs creation path for ring buffer (Naman Jain)
- tpm: tis: Double the timeout B to 4s (Michal Suchanek)
- tracing: probes: Fix a possible race in trace_probe_log APIs (Masami Hiramatsu)
- cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks (Waiman Long)
- arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout (Himanshu Bhavani)
- platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection (Hans de Goede)
- platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL) (Runhua He)
- binfmt_elf: Move brk for static PIE even if ASLR disabled (Kees Cook)
- riscv: dts: sophgo: fix DMA data-width configuration for CV18xx (Ze Huang)
- drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies (Mario Limonciello)
- drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC Policies (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list to always include security.* xattrs (Stephen Smalley)
- arm64: dts: rockchip: Assign RT5616 MCLK rate on rk3588-friendlyelec-cm3588 (Tom Vincent)
- LTS version: v6.12.29 (Jack Vogel)
- arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977004] {CVE-2025-37963}
- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976926] {CVE-2025-37948}
- arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
- arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
- arm64: insn: Add support for encoding DSB (James Morse)
- mm: page_alloc: speed up fallbacks in rmqueue_bulk() (Johannes Weiner)
- mm: page_alloc: don't steal single pages from biggest buddy (Johannes Weiner)
- Bluetooth: btmtk: Remove the resetting step before downloading the fw (Hao Qin)
- Bluetooth: btmtk: Remove resetting mt7921 before downloading the fw (Hao Qin)
- io_uring: always arm linked timeouts prior to issue (Jens Axboe)
- rust: clean Rust 1.88.0's `clippy::uninlined_format_args` lint (Miguel Ojeda)
- rust: allow Rust 1.87.0's `clippy::ptr_eq` lint (Miguel Ojeda)
- Revert "um: work around sched_yield not yielding in time-travel mode" (Christian Lamparter)
- do_umount(): add missing barrier before refcount checks in sync case (Al Viro)
- io_uring/sqpoll: Increase task_work submission batch size (Gabriel Krisman Bertazi)
- drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs (Tejas Upadhyay)
- drm/xe/tests/mocs: Update xe_force_wake_get() return handling (Himal Prasad Ghimiray)
- riscv: misaligned: enable IRQs while handling misaligned accesses (Clément Léger)
- riscv: misaligned: factorize trap handling (Clément Léger)
- nvme: unblock ctrl state transition for firmware update (Daniel Wagner)
- drm/panel: simple: Update timings for AUO G101EVN010 (Kevin Baker)
- loop: Add sanity check for read/write_iter (Lizhi Xu)
- loop: factor out a loop_assign_backing_file helper (Christoph Hellwig)
- loop: refactor queue limits updates (Christoph Hellwig)
- loop: Fix ABBA locking race (Ogawa Hirofumi)
- loop: Simplify discard granularity calc (John Garry)
- loop: Use bdev limit helpers for configuring discard (John Garry)
- riscv: misaligned: Add handling for ZCB instructions (Nylon Chen)
- MIPS: Fix MAX_REG_OFFSET (Thorsten Blum)
- iio: adc: dln2: Use aligned_s64 for timestamp (Jonathan Cameron)
- iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64 (Jonathan Cameron)
- types: Complement the aligned types with signed 64-bit one (Andy Shevchenko)
- iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer. (Jonathan Cameron)
- iio: accel: adxl367: fix setting odr for activity time update (Lothar Rubusch)
- usb: usbtmc: Fix erroneous generic_read ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous wait_srq ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous get_stb ioctl error returns (Dave Penkler)
- USB: usbtmc: use interruptible sleep in usbtmc_read (Oliver Neukum)
- usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015126] {CVE-2025-37994}
- usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition (Rd Babiera)
- usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs (Lukasz Czechowski)
- usb: host: tegra: Prevent host controller crash when OTG port is used (Jim Lin)
- usb: gadget: Use get_status callback to set remote wakeup capability (Prashanth K)
- usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN (Wayne Chang)
- usb: gadget: f_ecm: Add get_status callback (Prashanth K)
- usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version (Pawel Laszczak)
- usb: cdnsp: Fix issue with resuming from L1 (Pawel Laszczak)
- usb: dwc3: gadget: Make gadget_wakeup asynchronous (Prashanth K)
- x86/microcode: Consolidate the loader enablement checking (Borislav Petkov)
- module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015131] {CVE-2025-37995}
- memblock: Accept allocated memory before use in memblock_double_array() (Tom Lendacky) [Orabug: 37976994] {CVE-2025-37960}
- clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() (Sebastian Andrzej Siewior)
- arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong idmap generation (Levi Yun)
- accel/ivpu: Increase state dump msg timeout (Jacek Lawrynowicz)
- xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976934] {CVE-2025-37949}
- xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it (John Ernberg)
- smb: client: Avoid race in open_cached_dir with lease breaks (Paul Aurich) [Orabug: 37976959] {CVE-2025-37954}
- usb: uhci-platform: Make the clock really optional (Alexey Charkov)
- drm/amdgpu/hdp7: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amd/display: Copy AUX read reply data whenever length &gt; 0 (Wayne Lin)
- drm/amd/display: Fix wrong handling for AUX_DEFER case (Wayne Lin)
- drm/amd/display: Remove incorrect checking in dmub aux handler (Wayne Lin)
- drm/amd/display: Fix the checking condition in dmub aux handling (Wayne Lin)
- drm/amd/display: more liberal vmin/vmax update for freesync (Aurabindo Pillai)
- drm/amd/display: Fix invalid context error in dml helper (Roman Li) [Orabug: 37977185] {CVE-2025-37965}
- drm/amdgpu/vcn: using separate VCN1_AON_SOC offset (Ruijing Dong)
- drm/xe: Add page queue multiplier (Matthew Brost)
- drm/v3d: Add job to pending list if the reset was skipped (Maíra Canal) [Orabug: 37976942] {CVE-2025-37951}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug: 37977031] {CVE-2025-37969}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977037] {CVE-2025-37970}
- iio: imu: inv_mpu6050: align buffer for timestamp (David Lechner)
- iio: adis16201: Correct inclinometer channel resolution (Gabriel)
- iio: adc: rockchip: Fix clock initialization sequence (Simon Xue)
- iio: adc: ad7606: fix serial register access (Angelo Dureghello)
- io_uring: ensure deferred completions are flushed for multishot (Jens Axboe)
- drm/amd/display: Shift DMUB AUX reply command if necessary (Wayne Lin)
- KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (Mikhail Lobanov) [Orabug: 37976977] {CVE-2025-37957}
- selftests/mm: fix a build failure on powerpc (Nysal Jan K.A.)
- selftests/mm: compaction_test: support platform with huge mount of memory (Feng Tang)
- mm/userfaultfd: fix uninitialized output field for -EAGAIN race (Peter Xu)
- mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976982] {CVE-2025-37958}
- mm: fix folio_pte_batch() on XEN PV (Petr Vaněk)
- x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (Dave Hansen) [Orabug: 37977013] {CVE-2025-37964}
- staging: axis-fifo: Correct handling of tx_fifo_depth for size validation (Gabriel)
- staging: axis-fifo: Remove hardware resets for user errors (Gabriel)
- staging: bcm2835-camera: Initialise dev in v4l2_dev (Dave Stevenson) [Orabug: 37977042] {CVE-2025-37971}
- staging: iio: adc: ad7816: Correct conditional logic for store mode (Gabriel)
- rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.87.0 (Miguel Ojeda)
- rust: clean Rust 1.88.0's `unnecessary_transmutes` lint (Miguel Ojeda)
- Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 (Aditya Garg)
- Input: synaptics - enable SMBus for HP Elitebook 850 G1 (Dmitry Torokhov)
- Input: synaptics - enable InterTouch on Dell Precision M3800 (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30L-G (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30-D (Manuel Fombuena)
- Input: xpad - fix two controller table values (Vicki Pfau)
- Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller (Lode Willems)
- Input: xpad - fix Share button on Xbox One controllers (Vicki Pfau)
- Input: mtk-pmic-keys - fix possible null pointer dereference (Gary Bisson) [Orabug: 37977044] {CVE-2025-37972}
- Input: cyttsp5 - fix power control issue on wakeup (Mikael Gonella-Bolduc)
- Input: cyttsp5 - ensure minimum reset pulse width (Hugo Villeneuve)
- virtio-net: fix total qstat values (Jakub Kicinski)
- net: export a helper for adding up queue stats (Jakub Kicinski)
- fbnic: Do not allow mailbox to toggle to ready outside fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Pull fbnic_fw_xmit_cap_msg use out of interrupt context (Alexander Duyck)
- fbnic: Improve responsiveness of fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Actually flush_tx instead of stalling out (Alexander Duyck)
- fbnic: Gate AXI read/write enabling on FW mailbox (Alexander Duyck)
- fbnic: Fix initialization of mailbox descriptor rings (Alexander Duyck)
- net: dsa: b53: do not set learning and unicast/multicast on up (Jonas Gorski)
- net: dsa: b53: fix learning on VLAN unaware bridges (Jonas Gorski)
- net: dsa: b53: fix toggling vlan_filtering (Jonas Gorski)
- net: dsa: b53: do not program vlans when vlan filtering is off (Jonas Gorski)
- net: dsa: b53: do not allow to configure VLAN 0 (Jonas Gorski)
- net: dsa: b53: always rejoin default untagged VLAN on bridge leave (Jonas Gorski)
- net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave (Jonas Gorski)
- net: dsa: b53: fix flushing old pvid VLAN on pvid change (Jonas Gorski)
- net: dsa: b53: fix clearing PVID of a port (Jonas Gorski)
- net: dsa: b53: keep CPU port always tagged again (Jonas Gorski)
- net: dsa: b53: allow leaky reserved multicast (Jonas Gorski)
- bpf: Scrub packet on bpf_redirect_peer (Paul Chaignon) [Orabug: 37976990] {CVE-2025-37959}
- netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015141] {CVE-2025-37997}
- ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [Orabug: 37976996] {CVE-2025-37961}
- erofs: ensure the extra temporary copy is valid for shortened bvecs (Gao Xiang)
- ice: use DSN instead of PCI BDF for ice_adapter index (Przemek Kitszel)
- ice: Initial support for E825C hardware in ice_adapter (Sergey Temerkhanov)
- wifi: mac80211: fix the type of status_code for negotiated TID to Link Mapping (Michael-Cy Lee)
- can: gw: fix RCU/BH usage in cgw_create_job() (Oliver Hartkopp)
- can: mcp251xfd: fix TDC setting for low data bit rates (Kelsey Maes)
- can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe (Antonios Salios) [Orabug: 38015123] {CVE-2025-37993}
- net: ethernet: mtk_eth_soc: do not reset PSE when setting FE (Frank Wunderlich)
- net: ethernet: mtk_eth_soc: reset all TX queues on DMA free (Daniel Golle)
- gre: Fix again IPv6 link-local address generation. (Guillaume Nault)
- virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (Jakub Kicinski) [Orabug: 37976969] {CVE-2025-37955}
- virtio_net: xsk: bind/unbind xsk for tx (Xuan Zhuo)
- sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 37977176] {CVE-2025-37953}
- s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
- ksmbd: fix memory leak in parse_lease_state() (Zhaolong Wang) [Orabug: 37977180] {CVE-2025-37962}
- openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015148] {CVE-2025-37998}
- ksmbd: Fix UAF in __close_file_table_ids (Sean Heelan) [Orabug: 37976951] {CVE-2025-37952}
- ksmbd: prevent out-of-bounds stream writes by validating *pos (Norbert Szetei) [Orabug: 37976923] {CVE-2025-37947}
- ksmbd: prevent rename with empty string (Namjae Jeon) [Orabug: 37976972] {CVE-2025-37956}
- can: rockchip_canfd: rkcanfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Niklas Schnelle) [Orabug: 37976920] {CVE-2025-37946}
- vfio/pci: Align huge faults to order (Alex Williamson)
- wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation (Veerendranath Jakkam) [Orabug: 37977046] {CVE-2025-37973}
- s390/pci: Fix missing check for zpci_create_device() error return (Niklas Schnelle) [Orabug: 37977050] {CVE-2025-37974}
- can: mcan: m_can_class_unregister(): fix order of unregistration calls (Marc Kleine-Budde)
- firmware: arm_scmi: Fix timeout checks on polling path (Cristian Marussi)
- arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2 (Wojciech Dubowik)
- Revert "btrfs: canonicalize the device path before adding it" (Qu Wenruo)
- fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (Max Kellermann) [Orabug: 38015155] {CVE-2025-37999}
- dm: add missing unlock on in dm_keyslot_evict() (Dan Carpenter)
- mm/vmscan: wake up flushers conditionally to avoid cgroup OOM (Zeng Jingxiang) [Orabug: 37480932]
- dmaengine: idxd: Narrow the restriction on BATCH to ver. 1 only (Vinicius Costa Gomes) [Orabug: 37801355]
- uek-rpm: build the fwctl mlx5 driver on UEK (Qing Huang) [Orabug: 37810636]
- fwctl: Adapt upstream code for UEK8 (Mikhael Goikhman) [Orabug: 37810636]
- mlx5: Create an auxiliary device for fwctl_mlx5 (Saeed Mahameed) [Orabug: 37810636]
- fwctl/mlx5: Support for communicating with mlx5 fw (Saeed Mahameed) [Orabug: 37810636]
- fwctl: Add documentation (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware (Jason Gunthorpe) [Orabug: 37810636]
- taint: Add TAINT_FWCTL (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_INFO to return basic information about the device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Basic ioctl dispatch for the character device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Add basic structure for a class subsystem with a cdev (Jason Gunthorpe) [Orabug: 37810636]
- Revert "fwctl: Add basic structure for a class subsystem with a cdev" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Basic ioctl dispatch for the character device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_INFO to return basic information about the device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Support for communicating with mlx5 fw" (Qing Huang) [Orabug: 37810636]
- Revert "mlx5: Create an auxiliary device for fwctl_mlx5" (Qing Huang) [Orabug: 37810636]
- Revert "taint: Add TAINT_FWCTL" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Adapt code for UEK-NEXT" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Add INTERNAL_DEV_RES uctx capability" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Allow up to 4k devices" (Qing Huang) [Orabug: 37810636]
- Revert "uek-rpm: build the fwctl mlx5 driver on UEK" (Qing Huang) [Orabug: 37810636]
- dmaengine: idxd: Change err messages to dbg (Jack Vogel) [Orabug: 37841831]
- PCI: Add PCI_VDEVICE_SUB helper macro (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbevf: Add support for Intel(R) E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Enable link management in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Clean up the E610 link management related code (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add ixgbe_x540 multiple header inclusion protection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for EEPROM dump in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for NVM handling in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add link management support for E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 device capabilities detection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 FW Admin Command Interface (Piotr Kwapulinski) [Orabug: 37889575]
- uek-rpm: Move the gve kernel module from extra to kernel-uek-core (Samasth Norway Ananda) [Orabug: 37940897]
- uek-rpm/config-aarch64: Enable BT_HCIUART_BCM for RPi Bluetooth (Vijay Kumar) [Orabug: 37961540]
- platform/mellanox: mlxbf-pmc: Support additional PMC blocks (Shravan Kumar Ramani) [Orabug: 37964051]
- mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug: 37964051,38037120] {CVE-2025-37866}
- mlxbf-bootctl: Support sysfs entries for RTC battery status (Xiangrong Li) [Orabug: 37964051]
- platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37964051]
- uek-rpm: CONFIG_PTP_1588_CLOCK_OCP enable for OCI (Vijayendra Suman) [Orabug: 37966384]
- x86/its: Fix build errors when CONFIG_MODULES=n (Eric Biggers) [Orabug: 37970148]
- x86/its: Use dynamic thunks for indirect branches (Peter Zijlstra) [Orabug: 37970148]
- x86/ibt: Keep IBT disabled during alternative patching (Pawan Gupta) [Orabug: 37970148]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 37989268]
- amd_hsmp: Increase the SMU timeout to 500ms (Vijay Kumar) [Orabug: 38000074]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge)  [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang)  [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming)  [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams)  [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson)  [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley)  [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson)  [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson)  [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang)  [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang)  [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang)  [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang)  [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang)  [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang)  [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie)  [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie)  [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen)  [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen)  [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda)  [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda)  [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.1.el10uek]" date="1750939200">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.2.el10uek]" date="1752148800">- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38178286]  {CVE-2025-38089}
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38162790]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38175263]
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)  [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)  [Orabug: 38175246]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.3.el10uek]" date="1752494400">- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38171405]</changelog>
</package>
<package pkgid="5837ab6a619b599a150c2bd33817d6723d26c716" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="102.36.5.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge) [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang) [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming) [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams) [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson) [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley) [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson) [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson) [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang) [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang) [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang) [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang) [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang) [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang) [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie) [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie) [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen) [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen) [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda) [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda) [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger)  [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan)  [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan)  [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin)
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota)
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu)
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng)
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann)
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo)
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov)
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu)
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi)
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung)
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei Zhang)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Wentao Liang)
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold)
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-ji Chen)
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu)
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett)
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana)
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li (Intel))
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells)
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara)
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko)
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima)
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai)
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee)
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima)
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet)
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer)
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai)
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin)
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (SeongJae Park)
- smb: client: remove 	 from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima)
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski)
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev)
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo)
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski)
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang)
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin.Cao)
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng)
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke)
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun)
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (FUJITA Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin KaFai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu)
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra)
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher)
- smb: client: fix first command failure during re-negotiation (zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich)
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet)
- net: atm: add lec_mutex (Eric Dumazet)
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima)
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg)
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev)
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski)
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu)
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima)
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima)
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov)
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo)
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh AP)
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon)
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka)
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders)
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sá)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott)
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath SM)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal)
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn)
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis)
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam)
- Input: sparcspkr - avoid unannotated fall-through (WangYuli)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar)
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima)
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rong Zhang)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon)
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li (Intel))
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski)
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet)
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath SM)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin)
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov)
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang)
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton)
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes)
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook)
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Wentao Liang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij)
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo)
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner)
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu)
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh AP)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso)
- f2fs: fix to bail out in get_new_segment() (Chao Yu)
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski)
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R)
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin)
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao)
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S)
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (gldrk)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han)
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han)
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn)
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos)
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang)
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang)
- regulator: max14577: Add error check for max14577_read_reg() (Wentao Liang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel Shahrouzi)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann)
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz)
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin)
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Wentao Liang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Wentao Liang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams)
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'ichiro Kawasaki)
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park)
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (GONG Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu)
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim)
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski)
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han)
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu)
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim)
- f2fs: fix to do sanity check on ino and xnid (Chao Yu)
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter)
- ext4: only dirty folios when data journaling regular files (Brian Foster)
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo)
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis)
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko)
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin)
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeff Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar)
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski)
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian)
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev)
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis)
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li)
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Wentao Liang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis)
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park)
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann)
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng)
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (NeilBrown)
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh)
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter)
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Wentao Liang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Wentao Liang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Wentao Liang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F. R. A. Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li (Intel))
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner)
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov)
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt)
- 9p: Add a migrate_folio method (Matthew Wilcox (Oracle))
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (RD Babiera)
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby (SUSE))
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Wupeng Ma)
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard)
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov)
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge)
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox (Oracle))
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox (Oracle))
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig)
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang)
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana)
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski)
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet)
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet)
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet)
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin)
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz)
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski)
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski)
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj)
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui)
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani (IBM))
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet)
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang)
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park)
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz)
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav)
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold)
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro)
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki NAGAO)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski)
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel)
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal)
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari)
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song)
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng)
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré)
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré)
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak)
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas)
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen)
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Yeoreum Yun)
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz)
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (WangYuli)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang)
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin)
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar)
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin)
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang)
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng)
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe JAILLET)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe JAILLET)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski)
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin)
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov)
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin)
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov)
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin)
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei)
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Wentao Liang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher)
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F. R. A. Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo)
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima)
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam)
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur)
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang)
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (KaFai Wan)
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein)
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich)
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen)
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook)
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li RongQing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin)
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin)
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný)
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (ping.gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen)
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu)
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu)
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev)
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring (Arm))
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen)
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko)
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin)
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (YiFei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad)
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso)
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang)
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan)
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma)
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen XIN)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen XIN)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu)
- f2fs: prevent the current section from being selected as a victim during GC (yohan.joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter)
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu)
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen)
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen)
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang)
- xen/x86: fix initial memory balloon target (Roger Pau Monne)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon)
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A. R. Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin)
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe JAILLET)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao)
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao)
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland)
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown)
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han)
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian)
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo)
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot)
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong)
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu)
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F. R. A. Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu (Google))
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby (SUSE))
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait)
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper)
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli)  [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha)  [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137447]  {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky)  [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli)  [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly)  [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry)  [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson)  [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson)  [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry)  [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry)  [Orabug: 38026089]
- xfs: update atomic write limits (John Garry)  [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry)  [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry)  [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry)  [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry)  [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry)  [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong)  [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong)  [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry)  [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong)  [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry)  [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong)  [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong)  [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig)  [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig)  [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry)  [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry)  [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry)  [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry)  [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry)  [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry)  [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry)  [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry)  [Orabug: 38026089]
- dm-table: atomic writes support (John Garry)  [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry)  [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry)  [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry)  [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry)  [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry)  [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry)  [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry)  [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry)  [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry)  [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry)  [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry)  [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry)  [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry)  [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry)  [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry)  [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry)  [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen)  [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge)  [Orabug: 38137957]
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge)  [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge)  [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna)  [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju)  [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.1.el10uek]" date="1754481600">- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann)  [Orabug: 38217337]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.2.el10uek]" date="1755086400">- iommu/vt-d: Fix misplaced domain_attached assignment (Ban ZuoXiang)  [Orabug: 38294635]</changelog>
</package>
<package pkgid="75273e84eddd3172a0a8172c4ef48dcd4c972e2e" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger) [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo) [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan) [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan) [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
</package>
<package pkgid="d289638dae6ed41329cee72167c38a88e5d82e67" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]  
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
</package>
<package pkgid="8f21544ec6db85aade3984590095a1f5f2569503" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560} 
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500} 
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566} 
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571} 
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618} 
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
</package>
<package pkgid="4a2b507a63f541b4ec1f0376d7ceb2badcab6872" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560}
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500}
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566}
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571}
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618}
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.4.el10uek]" date="1759492800">- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton)  [Orabug: 38500610]  {CVE-2025-38724} 
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38500621]  {CVE-2025-39698} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38500629]  {CVE-2025-39881} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38500632]  {CVE-2025-39866}</changelog>
</package>
<package pkgid="d6b767ef849040350b4171735a6d4df1cf6590aa" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="104.43.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
</package>
<package pkgid="3ec9a3da22aac34fef2b95c437d32fa6ef57bfaf" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="104.43.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.3.el10uek]" date="1761220800">- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38572958]  {CVE-2025-39698} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38572953]  {CVE-2025-39866} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38572951]  {CVE-2025-3988} 
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon)  [Orabug: 38572950]  {CVE-2025-39718} 
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38572948]  {CVE-2025-39964} 
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)  [Orabug: 38572947]  {CVE-2025-39963} 
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)  [Orabug: 38572946]  {CVE-2025-39965} 
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski)  [Orabug: 38572944]  {CVE-2025-39946} 
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)  [Orabug: 38572943]  {CVE-2025-39977} 
- i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38572941]  {CVE-2025-39973}</changelog>
</package>
<package pkgid="ca667217174dd8bca2c1188f22204cf2ea5595d0" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="105.51.5.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)
- media: rc: fix races with imon_disconnect() (Larshin Sergey)
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik)
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)
- i40e: add validation for ring_len param (Lukasz Czapnik)
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.1.el10uek]" date="1764590400">- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu)  [Orabug: 38712788]  {CVE-2025-40019} 
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712786]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="8d0f59e2dcb0a69d55f0a4d73c69188b9e957f3c" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="105.51.5.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]  
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]  
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]  
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]  
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]  
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]  
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]  
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]  
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]  
- LTS version: v6.12.51 (Jack Vogel)   
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)   
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)   
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)   
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)   
- media: rc: fix races with imon_disconnect() (Larshin Sergey)   
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)   
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)   
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)   
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)   
- crypto: sha256 - fix crash at kexec (Breno Leitao)   
- LTS version v6.12.50 (Jack Vogel)   
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)   
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)   
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)   
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)   
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)   
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)   
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)   
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)   
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)   
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)   
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)   
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)   
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)   
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)   
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))   
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)   
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)   
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)   
- i40e: add max boundary check for VF filters (Lukasz Czapnik)   
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)   
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)   
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)   
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)   
- i40e: add validation for ring_len param (Lukasz Czapnik)   
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)   
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)   
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)   
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)   
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)   
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)   
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)   
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)   
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)   
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)   
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)   
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)   
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)   
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)   
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)   
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)   
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)   
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)   
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)   
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)   
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)   
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)   
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)   
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)   
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)   
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)   
- wifi: virt_wifi: Fix page fault on connect (James Guan)   
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)   
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)   
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)   
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)   
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)   
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)   
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)   
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)   
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)   
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)   
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)   
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)   
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)   
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)   
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)   
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)   
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)   
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)   
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)   
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)   
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)   
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)   
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)   
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)   
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)   
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
</package>
<package pkgid="62a48ef96e7023525438babfcfb97b60699cbc2d" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="106.55.4.1.el10uek"/>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="0abda75452a09a47d1f0a4988ed098a84e93ba0d" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="106.55.4.2.el10uek"/>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.2.el10uek]" date="1766145600">- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)   {CVE-2025-40271} 
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="45856a3ad12d5fa207e073a138d35a84c726ae14" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="8f73f083018bfd7750967dab38b13ac1042183d3" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
</package>
<package pkgid="3a1d76fd0f2923eb9d5312b99cde6a623350e262" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.4.el10uek]" date="1770292800">- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet)  [Orabug: 38932996]  {CVE-2025-40257} 
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38932973]  {CVE-2025-40149} 
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet)  [Orabug: 38932955]  {CVE-2025-40258} 
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38932939]</changelog>
</package>
<package pkgid="659f09517e3ac65bd203869bf9d6c2697a467339" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="108.64.6.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge) [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp) [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal) [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.62.1.el10uek]" date="1765886400">- uek-rpm: Allow disabling kabichk at command line (Yifei Liu) [Orabug: 38733049]
- Revert "xfrm: Use xdo.dev instead of xdo.real_dev" (Jack Vogel) [Orabug: 38718730]
- Revert "net/mlx5: Fix IPsec cleanup over MPV device" (Jack Vogel) [Orabug: 38718730]
- LTS version: v6.12.62 (Jack Vogel)
- bus: mhi: host: pci_generic: Add Telit FN990B40 modem support (Daniele Palmas)
- bus: mhi: host: pci_generic: Add Telit FN920C04 modem support (Daniele Palmas)
- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (Navaneeth K)
- staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (Navaneeth K)
- staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (Navaneeth K)
- comedi: check device's attached status in compat ioctls (Nikita Zhandarovich)
- comedi: multiq3: sanitize config options in multiq3_attach() (Nikita Zhandarovich)
- comedi: c6xdigio: Fix invalid PNP driver unregistration (Ian Abbott)
- wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (Zenm Chen)
- wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1 (Zenm Chen)
- samples: work around glibc redefining some of our defines wrong (Linus Torvalds)
- LoongArch: Mask all interrupts during kexec/kdump (Huacai Chen)
- HID: elecom: Add support for ELECOM M-XT3URBK (018F) (Naoki Ueki)
- platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (Antheas Kapenekakis)
- platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (Antheas Kapenekakis)
- platform/x86: huawei-wmi: add keys for HONOR models (Ston Jia)
- HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (April Grimoire)
- platform/x86: acer-wmi: Ignore backlight event (Armin Wolf)
- pinctrl: qcom: msm: Fix deadlock in pinmux configuration (Praveen Talari)
- nvme: fix admin request_queue lifetime (Keith Busch) [Orabug: 38773611] {CVE-2025-68265}
- HID: hid-input: Extend Elan ignore battery quirk to USB (Mario Limonciello)
- bfs: Reconstruct file type when loading from disk (Tetsuo Handa)
- ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (Lushih Hsieh)
- drm/amdkfd: Fix GPU mappings for APU after prefetch (Harish Kasiviswanathan)
- smb: fix invalid username check in smb3_fs_context_parse_param() (Yiqi Sun)
- Bluetooth: btrtl: Avoid loading the config file on security chips (Max Chou)
- drm/vmwgfx: Use kref in vmw_bo_dirty (Ian Forbes)
- spi: imx: keep dma request disabled before dma transfer setup (Robin Gong)
- spi: xilinx: increase number of retries before declaring stall (Alvaro Gamez Machado)
- ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() (Song Liu)
- USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- serial: add support of CPCI cards (Magne Bruno)
- USB: serial: ftdi_sio: match on interface number for jtag (Johan Hovold)
- USB: serial: option: move Telit 0x10c7 composition in the right place (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FE910C04 new compositions (Fabio Porcedda)
- USB: serial: option: add Foxconn T99W760 (Slark Xiao)
- KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (Omar Sandoval) [Orabug: 38773578] {CVE-2025-68259}
- comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (Nikita Zhandarovich)
- ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (Alexey Nepomnyashih) [Orabug: 38773586] {CVE-2025-68261}
- locking/spinlock/debug: Fix data-race in do_raw_write_lock (Alexander Sverdlin)
- ksmbd: ipc: fix use-after-free in ipc_msg_send_request (Qianchang Zhao)
- ext4: refresh inline data size before write operations (Deepanshu Kartikey) [Orabug: 38773602] {CVE-2025-68264}
- jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (Ye Bin) [Orabug: 38792632] {CVE-2025-68337}
- Documentation: process: Also mention Sasha Levin as stable tree maintainer (Bagas Sanjaya)
- xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca)
- xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)
- Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca)
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca) [Orabug: 38730491,38854317] {CVE-2025-40215}
- LTS version: v6.12.61 (Jack Vogel)
- spi: spi-nxp-fspi: Check return value of devm_mutex_init() (Thomas Weißschuh)
- drm/i915/dp: Initialize the source OUI write timestamp always (Imre Deak)
- Revert "ACPI: Suppress misleading SPCR console message when SPCR table is absent" (Punit Agrawal)
- wifi: ath12k: correctly handle mcast packets for clients (Sarika Sharma)
- net: dsa: microchip: Free previously initialized ports on init failures (Bastien Curutchet)
- net: dsa: microchip: Do not execute PTP driver code for unsupported switches (Tristram Ha)
- drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (Thomas Zimmermann) [Orabug: 38773709] {CVE-2025-68296}
- net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() (Bastien Curutchet)
- KVM: SVM: Fix redundant updates of LBR MSR intercepts (Yosry Ahmed)
- KVM: nSVM: Fix and simplify LBR virtualization handling with nested (Yosry Ahmed)
- KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() (Yosry Ahmed)
- KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts() (Yosry Ahmed)
- mm/huge_memory: fix NULL pointer deference when splitting folio (Wei Yang) [Orabug: 38773700] {CVE-2025-68293}
- usb: gadget: udc: fix use-after-free in usb_gadget_state_work (Jimmy Hu) [Orabug: 38773635] {CVE-2025-68282}
- usb: udc: Add trace event for usb_gadget_set_state (Kuen-Han Tsai)
- can: rcar_canfd: Fix CAN-FD mode as default (Biju Das)
- usb: typec: ucsi: psy: Set max current to zero when disconnected (Jameson Thies)
- nfsd: Replace clamp_t in nfsd4_get_drc_mem() (Neil Brown)
- staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann)
- libceph: replace BUG_ON with bounds check for map-&gt;max_osd (Ziming Zhang) [Orabug: 38773641] {CVE-2025-68283}
- libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773648] {CVE-2025-68284}
- libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773654] {CVE-2025-68285}
- net: dsa: microchip: Don't free uninitialized ksz_irq (Bastien Curutchet)
- net: dsa: microchip: ptp: Fix checks on irq_find_mapping() (Bastien Curutchet)
- net: dsa: microchip: common: Fix checks on irq_find_mapping() (Bastien Curutchet)
- drm/amd/display: Don't change brightness for disabled connectors (Mario Limonciello)
- drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773661] {CVE-2025-68286}
- drm/amd/amdgpu: reserve vm invalidation engine for uni_mes (Michael Chen)
- drm: sti: fix device leaks at component probe (Johan Hovold)
- USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang)
- USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov)
- xhci: dbgtty: fix device unregister (Łukasz Bartosik)
- xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman)
- xhci: fix stale flag preventig URBs after link state error is cleared (Mathias Nyman)
- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar)
- usb: dwc3: pci: Sort out the Intel device IDs (Krogerus Heikki)
- usb: dwc3: pci: add support for the Intel Nova Lake -S (Krogerus Heikki)
- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792592] {CVE-2025-68331}
- usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762728] {CVE-2025-40345}
- USB: storage: Remove subclass and protocol overrides from Novatek quirk (Alan Stern)
- usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773676] {CVE-2018-1000204,CVE-2025-68288}
- usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea)
- usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai)
- usb: cdns3: Fix double resource release in cdns3_pci_probe (Miaoqian Lin)
- most: usb: fix double free on late probe failure (Johan Hovold)
- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin)
- mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). (Kuniyuki Iwashima)
- mptcp: clear scheduled subflows on retransmit (Paolo Abeni)
- mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level (Jisheng Zhang)
- mm/memfd: fix information leak in hugetlb folios (Deepanshu Kartikey) [Orabug: 38773697] {CVE-2025-68292}
- firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli)
- nvmem: layouts: fix nvmem_layout_bus_uevent (Guan Wentao)
- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin)
- thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski)
- smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773703] {CVE-2025-68295}
- drivers/usb/dwc3: fix PCI parent check (Jamie Iles)
- dm-verity: fix unreliable memory allocation (Mikulas Patocka)
- ceph: fix crash in process_v2_sparse_read() for encrypted directories (Viacheslav Dubeyko) [Orabug: 38773716] {CVE-2025-68297}
- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde)
- can: sja1000: fix max irq loop handling (Thomas Mühlbacher)
- Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref (Douglas Anderson) [Orabug: 38773723] {CVE-2025-68298}
- atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han)
- ARM: dts: nxp: imx6ul: correct SAI3 interrupt line (Maarten Zanders)
- arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity (Xu Yang)
- arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos (Frank Li)
- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (Ivan Zhaldak)
- tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (Deepanshu Kartikey) [Orabug: 38792583] {CVE-2025-68329}
- MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow (Thomas Bogendoerfer)
- MIPS: mm: Prevent a TLB shutdown on initial uniquification (Maciej W. Rozycki)
- iio: adc: rtq6056: Correct the sign bit index (Chiyuan Huang)
- iio: adc: ad7280a: fix ad7280_store_balance_timer() (David Lechner)
- iio: accel: fix ADXL355 startup race condition (Valek Andrej)
- iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792585] {CVE-2025-68330}
- iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling (Olivier Moysan)
- iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet)
- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra)
- iio: humditiy: hdc3020: fix units for thresholds and hysteresis (Dimitri Fedrau)
- iio: humditiy: hdc3020: fix units for temperature and humidity measurement (Dimitri Fedrau)
- iio: buffer: support getting dma channel from the buffer (Nuno Sa)
- iio: buffer-dmaengine: enable .get_dma_dev() (Nuno Sa)
- iio: buffer-dma: support getting the DMA channel (Nuno Sa)
- Revert "perf/x86: Always store regs-&gt;ip in perf_callchain_kernel()" (Jiri Olsa)
- Revert "drm/amd/display: Move setup_stream_attribute" (Alex Deucher)
- spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou)
- spi: nxp-fspi: Propagate fwnode in ACPI case as well (Andy Shevchenko)
- spi: spi-nxp-fspi: Add OCT-DTR mode support (Haibo Chen)
- spi: spi-nxp-fspi: remove the goto in probe (Haibo Chen)
- spi: nxp-fspi: Support per spi-mem operation frequency switches (Miquel Raynal)
- spi: spi-mem: Add a new controller capability (Miquel Raynal)
- spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency (Miquel Raynal)
- spi: spi-mem: Allow specifying the byte order in Octal DTR mode (Tudor Ambarus)
- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (Xu Wang)
- spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA (Francesco Lavra)
- fs/namespace: fix reference leak in grab_requested_mnt_ns (Andrei Vagin) [Orabug: 38773950] {CVE-2025-68300}
- mailbox: pcc: don't zero error register (Jamie Iles)
- mailbox: pcc: Refactor error handling in irq handler into separate function (Sudeep Holla)
- mailbox: mtk-cmdq: Refine DMA address handling for the command buffer (Jason-JH Lin)
- mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang)
- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (Xu Wang)
- iio: st_lsm6dsx: Fixed calibrated timestamp calculation (Mario Tesi)
- net: fec: do not register PPS event for PEROUT (Wei Fang)
- net: fec: do not allow enabling PPS and PEROUT simultaneously (Wei Fang)
- net: fec: do not update PEROUT if it is enabled (Wei Fang)
- net: fec: cancel perout_timer when PEROUT is disabled (Wei Fang)
- net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773728] {CVE-2025-68301}
- eth: fbnic: Fix counter roll-over issue (Mohsin Bashir)
- net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean)
- net: dsa: sja1105: simplify static configuration reload (Russell King)
- net: wwan: mhi: Keep modem name match with Foxconn T99W640 (Slark Xiao)
- drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (Alex Deucher)
- net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev)
- team: Move team device type change at the end of team_port_add (Nikola Z. Ivanov) [Orabug: 38796270] {CVE-2025-68340}
- net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino)
- drm/xe: Fix conversion from clock ticks to milliseconds (Harish Chegondi)
- net: lan966x: Fix the initialization of taprio (Horatiu Vultur)
- net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng)
- platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter)
- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (Daniel Golle)
- veth: reduce XDP no_direct return section to fix race (Jesper Dangaard Brouer) [Orabug: 38796276] {CVE-2025-68341}
- veth: more robust handing of race to avoid txq getting stuck (Jesper Dangaard Brouer)
- veth: prevent NULL pointer dereference in veth_xdp_rcv (Jesper Dangaard Brouer)
- veth: apply qdisc backpressure on full ptr_ring to reduce TX drops (Jesper Dangaard Brouer)
- net: sched: generalize check for no-queue qdisc on TX queue (Jesper Dangaard Brouer)
- Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz)
- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (Edward Adam Davis) [Orabug: 38773949] {CVE-2025-68305}
- Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP (Luiz Augusto von Dentz)
- Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface (Chris Lu) [Orabug: 38773748] {CVE-2025-68306}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data (Marc Kleine-Budde) [Orabug: 38796278] {CVE-2025-68342}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header (Marc Kleine-Budde) [Orabug: 38796285] {CVE-2025-68343}
- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (Marc Kleine-Budde) [Orabug: 38773751] {CVE-2025-68307}
- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [Orabug: 38773759] {CVE-2025-68308}
- LTS version: v6.12.60 (Jack Vogel)
- Revert "gpio: swnode: don't use the swnode's name as the key for GPIO lookup" (Charles Keepax)
- drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched (Fangzhi Zuo)
- drm/amd/display: Insert dccg log for easy debug (Charlene Liu)
- drm/amd/display: disable DPP RCG before DPP CLK enable (Charlene Liu)
- drm/amd/display: avoid reset DTBCLK at clock init (Charlene Liu)
- xfs: fix out of bounds memory read error in symlink repair (Darrick J. Wong) [Orabug: 38730602] {CVE-2025-40246}
- xfs: Replace strncpy with memcpy (Marcelo Moreira)
- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730655] {CVE-2025-40257}
- drm/i915/dp_mst: Disable Panel Replay (Imre Deak)
- maple_tree: fix tracepoint string pointers (Martin Kaiser)
- tty/vt: fix up incorrect backport to stable releases (Jari Ruusu)
- smb: client: fix incomplete backport in cfids_invalidation_worker() (Henrique Carvalho)
- drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (Samuel Zhang) [Orabug: 38773445] {CVE-2025-68230}
- tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun)
- net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
- ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe)
- s390/mm: Fix __ptep_rdp() inline assembly (Heiko Carstens)
- drm/xe: Prevent BIT() overflow when handling invalid prefetch region (Shuicheng Lin)
- Revert "RDMA/irdma: Update Kconfig" (Guan Wentao)
- KVM: arm64: Make all 32bit ID registers fully writable (Marc Zyngier)
- ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai)
- kconfig/nconf: Initialize the default locale at startup (Jakub Horký)
- kconfig/mconf: Initialize the default locale at startup (Jakub Horký)
- net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit)
- blk-crypto: use BLK_STS_INVAL for alignment errors (Carlos Llamas)
- net: tls: Change async resync helpers argument (Shahar Shitrit)
- selftests: net: use BASH for bareudp testing (Po-Hsu Lin)
- x86/microcode/AMD: Limit Entrysign signature checking to known generations (Borislav Petkov)
- scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773425] {CVE-2025-68224}
- cifs: fix typo in enable_gcm_256 module parameter (Steve French)
- bcma: don't register devices disabled in OF (Rafał Miłecki)
- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730610] {CVE-2025-40248}
- cifs: fix memory leak in smb3_fs_context_parse_param error path (Shaurya Rane) [Orabug: 38773403] {CVE-2025-68219}
- LoongArch: Use UAPI types in ptrace UAPI header (Thomas Weißschuh)
- af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic(). (Kuniyuki Iwashima)
- af_unix: Cache state-&gt;msg in unix_stream_read_generic(). (Kuniyuki Iwashima)
- devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (Shay Drory) [Orabug: 38730623] {CVE-2025-40251}
- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (Jared Kangas)
- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (Jared Kangas)
- ice: fix PTP cleanup on driver removal in error path (Grzegorz Nitka) [Orabug: 38773389] {CVE-2025-68215}
- idpf: fix possible vport_config NULL pointer deref in remove (Emil Tantilov) [Orabug: 38773956] {CVE-2025-68213}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730628] {CVE-2025-40252}
- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang)
- selftests: net: lib: Do not overwrite error messages (Ido Schimmel)
- s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
- nvme-multipath: fix lockdep WARN due to partition scan work (Shin'Ichiro Kawasaki) [Orabug: 38773400] {CVE-2025-68218}
- tools: riscv: Fixed misalignment of CSR related definitions (Chen Pei)
- net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730647] {CVE-2025-40254}
- net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() (Pavel Zhigulin)
- net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin)
- drm/tegra: Add call to put_pid() (Prateek Agarwal) [Orabug: 38773463] {CVE-2025-68233}
- mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
- platform/x86: msi-wmi-platform: Fix typo in WMI GUID (Armin Wolf)
- platform/x86: msi-wmi-platform: Only load on MSI devices (Armin Wolf)
- pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() (Xu Wang)
- xfrm: Prevent locally generated packets from direct output in tunnel mode (Jianbo Liu)
- xfrm: Determine inner GSO type from packet inner protocol (Jianbo Liu)
- pinctrl: realtek: Select REGMAP_MMIO for RTD driver (Yu-Chun Lin)
- xfrm: set err and extack on failure to create pcpu SA (Sabrina Dubroca)
- xfrm: drop SA reference in xfrm_state_update if dir doesn't match (Sabrina Dubroca)
- drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 (Ivan Lipski)
- drm/amd/display: Fix pbn to kbps Conversion (Fangzhi Zuo)
- drm/amd/display: Move sleep into each retry for retrieve_link_cap() (Mario Limonciello)
- drm/amd/display: Increase DPCD read retries (Mario Limonciello)
- drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (Yifan Zha)
- drm/amd: Skip power ungate during suspend for VPE (Mario Limonciello)
- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (Robert Mcclinton) [Orabug: 38773418] {CVE-2025-68223}
- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke)
- mptcp: do not fallback when OoO is present (Paolo Abeni)
- mptcp: decouple mptcp fastclose from tcp close (Paolo Abeni)
- mptcp: avoid unneeded subflow-level drops (Paolo Abeni)
- selftests: mptcp: join: userspace: longer timeout (Matthieu Baerts)
- selftests: mptcp: join: endpoints: longer timeout (Matthieu Baerts)
- mptcp: fix premature close in case of fallback (Paolo Abeni)
- mptcp: fix duplicate reset on fastclose (Paolo Abeni)
- mptcp: fix ack generation for fallback msk (Paolo Abeni)
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730658] {CVE-2025-40258}
- LoongArch: Don't panic if no valid cache info for PCI (Huacai Chen)
- dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski)
- MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
- scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773439] {CVE-2025-68229}
- scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730661] {CVE-2025-40259}
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730672] {CVE-2025-40261}
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne)
- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (Nam Cao) [Orabug: 38773467] {CVE-2025-68235}
- mm/mempool: fix poisoning order&gt;0 pages with HIGHMEM (Vlastimil Babka) [Orabug: 38773453] {CVE-2025-68231}
- Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
- Input: imx_sc_key - fix memory corruption on unload (Dan Carpenter)
- Input: goodix - add support for ACPI ID GDIX1003 (Hans de Goede)
- Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730679] {CVE-2025-40263}
- Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" (Diogo Ivo)
- net: dsa: microchip: lan937x: Fix RGMII delay tuning (Oleksij Rempel)
- be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730688] {CVE-2025-40264}
- ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() (Yihang Li)
- smb: client: introduce close_cached_dir_locked() (Henrique Carvalho)
- ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
- mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773434] {CVE-2025-68227}
- mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen)
- exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang)
- shmem: fix tmpfs reconfiguration (remount) when noswap is set (Mike Yuan)
- isofs: check the return value of sb_min_blocksize() in isofs_fill_super (Yongpeng Yang)
- mtdchar: fix integer overflow in read/write ioctls (Dan Carpenter) [Orabug: 38773476] {CVE-2025-68237}
- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara)
- arm64: dts: rockchip: disable HS400 on RK3588 Tiger (Quentin Schulz)
- arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1 (Quentin Schulz)
- arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5 (Mykola Kvach)
- arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2 (Diederik de Haas)
- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
- HID: amd_sfh: Stop sensor before starting (Mario Limonciello)
- timers: Fix NULL function pointer race in timer_shutdown_sync() (Yipeng Zou) [Orabug: 38773387] {CVE-2025-68214}
- KVM: arm64: Check the untrusted offset in FF-A memory share (Sebastian Ene) [Orabug: 38730696] {CVE-2025-40266}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.2.el10uek]" date="1766491200">- LTS version: v6.12.63 (Jack Vogel)
- ASoC: codecs: nau8325: Silence uninitialized variables warnings (Krzysztof Kozlowski)
- ALSA: wavefront: Fix integer overflow in sample size validation (Junrui Luo)
- ALSA: dice: fix buffer overflow in detect_stream_formats() (Junrui Luo)
- usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required (Sven Peter)
- usb: phy: Initialize struct usb_phy list_head (Diogo Ivo)
- usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (Haotien Hsu)
- tcp_metrics: use dst_dev_net_rcu() (Eric Dumazet) [Orabug: 38592188] {CVE-2025-40075}
- net: dst: introduce dst-&gt;dev_rcu (Eric Dumazet)
- net: lan743x: Allocate rings outside ZONE_DMA (Thangaraj Samynathan)
- LoongArch: Add machine_kexec_mask_interrupts() implementation (Huacai Chen)
- ocfs2: fix memory leak in ocfs2_merge_rec_left() (Dmitry Antipov)
- irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (Dan Carpenter)
- scsi: imm: Fix use-after-free bug caused by unfinished delayed work (Duoming Zhou) [Orabug: 38783113] {CVE-2025-68324}
- efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs (Mauro Carvalho Chehab)
- efi/cper: Adjust infopfx size to accept an extra space (Mauro Carvalho Chehab)
- efi/cper: Add a new helper function to print bitmasks (Mauro Carvalho Chehab)
- dm log-writes: Add missing set_freezable() for freezable kthread (Xu Wang)
- dm-raid: fix possible NULL dereference with undefined raid type (Alexey Simakov)
- block: return unsigned int from queue_dma_alignment (Christoph Hellwig)
- block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set-&gt;tag_list_lock (Mohamed Khalfella) [Orabug: 38818209] {CVE-2025-68756}
- ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() (Pangliyuan)
- ALSA: firewire-motu: add bounds check in put_user loop for DSP events (Junrui Luo)
- rtc: gamecube: Check the return value of ioremap() (Xu Wang)
- drm/amdkfd: Use huge page size to check split svm range alignment (Xiaogang Chen)
- ALSA: uapi: Fix typo in asound.h comment (Andres J Rosa)
- docs: hwmon: fix link to g762 devicetree binding (Kathara Sasikumar)
- cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 (David Howells)
- drm/nouveau: refactor deprecated strcpy (Madhur Kumar)
- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (Junrui Luo)
- regulator: fixed: Rely on the core freeing the enable GPIO (Mark Brown)
- drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() (Dan Carpenter)
- nvme-auth: use kvfree() for memory allocated with kvcalloc() (Israel Rukshin)
- block: fix memory leak in __blkdev_issue_zero_pages (Shaurya Rane) [Orabug: 38798772] {CVE-2025-68348}
- block: fix comment for op_is_zone_mgmt() to include RESET_ALL (Shechenglong)
- blk-mq: Abort suspend when wakeup events are pending (Cong Zhang)
- ASoC: ak5558: Disable regulator when error happens (Shengjiu Wang)
- ASoC: ak4458: Disable regulator when error happens (Shengjiu Wang)
- ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (Xu Wang)
- platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (Anton Khirnov)
- fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() (Armin Wolf)
- NFS: Fix inheritance of the block sizes when automounting (Trond Myklebust)
- Expand the type of nfs_fattr-&gt;valid (Trond Myklebust)
- NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (Trond Myklebust) [Orabug: 38818236] {CVE-2025-68764}
- Revert "nfs: ignore SB_RDONLY when mounting nfs" (Trond Myklebust)
- Revert "nfs: clear SB_RDONLY before getting superblock" (Trond Myklebust)
- Revert "nfs: ignore SB_RDONLY when remounting nfs" (Trond Myklebust)
- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (Jonathan Curley) [Orabug: 38798774] {CVE-2025-68349}
- NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state (Trond Myklebust)
- nfs/vfs: discard d_exact_alias() (Neil Brown)
- NFS: Initialise verifiers for visible dentries in nfs_atomic_open() (Trond Myklebust)
- NFS: Initialise verifiers for visible dentries in readdir and lookup (Trond Myklebust)
- fs/nls: Fix utf16 to utf8 conversion (Armin Wolf)
- NFS: Avoid changing nlink when file removes and attribute updates race (Trond Myklebust)
- f2fs: maintain one time GC mode is enabled during whole zoned GC cycle (Daeho Jeong)
- f2fs: add gc_boost_gc_greedy sysfs node (Daeho Jeong)
- f2fs: add gc_boost_gc_multiple sysfs node (Daeho Jeong)
- f2fs: introduce reserved_pin_section sysfs entry (Chao Yu)
- f2fs: sysfs: add encoding_flags entry (Chao Yu)
- f2fs: add carve_out sysfs node (Daeho Jeong)
- f2fs: fix to avoid running out of free segments (Chao Yu)
- f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages (Jaegeuk Kim)
- f2fs: keep POSIX_FADV_NOREUSE ranges (Jaegeuk Kim)
- platform/x86:intel/pmc: Update Arrow Lake telemetry GUID (Xi Pardee)
- sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out (Xupengbo)
- 9p: fix cache/debug options printing in v9fs_show_options (Eric Sandeen)
- fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (Abdun Nihaal)
- pinctrl: single: Fix incorrect type for error return variable (Xu Wang)
- perf hist: In init, ensure mem_info is put on error paths (Ian Rogers)
- perf tools: Fix split kallsyms DSO counting (Namhyung Kim)
- perf tools: Mark split kallsyms DSOs as loaded (Namhyung Kim)
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei) [Orabug: 38783136] {CVE-2025-68325}
- net: dsa: xrs700x: reject unsupported HSR configurations (Vladimir Oltean)
- net: hsr: create an API to get hsr port type (Xiaoliang Yang)
- net: hsr: Create and export hsr_get_port_ndev() (Md Danish Anwar)
- net: hsr: remove synchronize_rcu() from hsr_add_port() (Eric Dumazet)
- net: hsr: remove one synchronize_rcu() from hsr_del_port() (Eric Dumazet)
- clk: keystone: fix compile testing (Johan Hovold)
- md/raid5: fix IO hang when array is broken with IO inflight (Yu Kuai)
- remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs (Alexandru Gagniuc)
- mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (Ivan Stepchenko)
- selftests: bonding: add delay before each xvlan_over_bond connectivity check (Hangbin Liu)
- selftests: bonding: add ipvlan over bond testing (Etienne Champetier)
- net: phy: aquantia: check for NVMEM deferral (Robert Marko)
- vfio/pci: Use RCU for error/request triggers to avoid circular locking (Alex Williamson)
- spi: ch341: fix out-of-bounds memory access in ch341_transfer_one (Tianchu Chen)
- mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (Xu Wang)
- net: stmmac: fix rx limit check in stmmac_rx_zc() (Alexey Kodanev)
- netfilter: nft_connlimit: update the count if add was skipped (Fernando Fernandez Mancera)
- netfilter: nf_conncount: rework API to use sk_buff directly (Fernando Fernandez Mancera)
- netfilter: flowtable: check for maximum number of encapsulations in bridge vlan (Pablo Neira Ayuso)
- Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" (Ilias Stamatis)
- resource: introduce is_type_match() helper and use it (Andy Shevchenko)
- resource: replace open coded resource_intersection() (Andy Shevchenko)
- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (Sparkhuang) [Orabug: 38798786] {CVE-2025-68354}
- ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND (Mikhail Kshevetskiy)
- ASoC: Intel: catpt: Fix error path in hw_params() (Cezary Rojewski)
- vdpa/pds: use %pe for ERR_PTR() in event handler registration (Alok Tiwari)
- vhost: Fix kthread worker cgroup failure handling (Mike Christie)
- vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues (Alok Tiwari)
- virtio: fix virtqueue_set_affinity() docs (Michael S. Tsirkin)
- virtio: fix grammar in virtio_queue_info docs (Michael S. Tsirkin)
- virtio: fix whitespace in virtio_config_ops (Michael S. Tsirkin)
- virtio: fix typo in virtio_device_ready() comment (Michael S. Tsirkin)
- virtio_vdpa: fix misleading return in void function (Alok Tiwari)
- of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node (Guenter Roeck)
- ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation (Yongjian Sun)
- ublk: prevent invalid access with DEBUG (Kevin Brodsky)
- ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (René Rebe)
- hwmon: sy7636a: Fix regulator_enable resource leak on error path (Xu Wang)
- drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (Dan Carpenter)
- greybus: gb-beagleplay: Fix timeout handling in bootloader functions (Xu Wang)
- firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER (Alexandre Courbot)
- ASoC: fsl_xcvr: clear the channel status control memory (Shengjiu Wang)
- gfs2: Prevent recursive memory reclaim (Andreas Gruenbacher) [Orabug: 38798793] {CVE-2025-68356}
- ASoC: nau8325: add missing build config (Jaroslav Kysela)
- ASoC: nau8325: use simple i2c probe function (Jaroslav Kysela)
- drm/panthor: Avoid adding of kernel BOs to extobj list (Akash Goel)
- RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY (Jacob Moroni)
- RDMA/irdma: Fix data race in irdma_free_pble (Krzysztof Czurylo)
- RDMA/irdma: Fix data race in irdma_sc_ccq_arm (Krzysztof Czurylo)
- iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal (Stephan Gerhold)
- backlight: lp855x: Fix lp855x.h kernel-doc warnings (Randy Dunlap)
- backlight: led-bl: Add devlink to supplier LEDs (Luca Ceresoli)
- wifi: ieee80211: correct FILS status codes (Ria Thomas)
- iomap: always run error completions in user context (Christoph Hellwig)
- iomap: factor out a iomap_dio_done helper (Christoph Hellwig)
- um: Don't rename vmap to kernel_vmap (David Gow)
- drm/nouveau: restrict the flush page to a 32-bit address (Timur Tabi)
- PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (Shawn Lin)
- btrfs: fix leaf leak in an error path in btrfs_del_items() (Filipe Manana)
- iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables (Ryan Huang)
- staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (Jianglei Nie)
- firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (Dinh Nguyen)
- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (Zilin Guan)
- ASoC: tas2781: correct the wrong period (Shenghao Ding)
- RDMA/bnxt_re: Pass correct flag for dma mr creation (Selvin Xavier)
- RDMA/bnxt_re: Fix the inline size for GenP7 devices (Selvin Xavier)
- erofs: limit the level of fs stacking for file-backed mounts (Gao Xiang)
- RISC-V: KVM: Fix guest page fault within HLV* instructions (Fangyu Yu)
- crypto: ccree - Correctly handle return of sg_nents_for_len (Xu Wang)
- crypto: starfive - Correctly handle return of sg_nents_for_len (Xu Wang)
- selftests/bpf: Improve reliability of test_perf_branches_no_hw() (Matt Bobrowski)
- selftests/bpf: skip test_perf_branches_hw() on unsupported platforms (Matt Bobrowski)
- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon)
- usb: dwc2: fix hang during suspend if set as peripheral (Jisheng Zhang)
- usb: dwc2: fix hang during shutdown if set as peripheral (Jisheng Zhang)
- usb: dwc2: disable platform lowlevel hw resources during shutdown (Jisheng Zhang)
- usb: chaoskey: fix locking for O_NONBLOCK (Oliver Neukum)
- ima: Handle error code returned by ima_filter_rule_match() (Zhao Yipeng) [Orabug: 38798921] {CVE-2025-68740}
- RAS: Report all ARM processor CPER information to userspace (Jason Tian)
- wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (Seungjin Bae) [Orabug: 38798814] {CVE-2025-68362}
- cpuset: Treat cpusets in attaching as populated (Chen Ridong)
- net: phy: adin1100: Fix software power-down ready condition (Alexander Dahl)
- phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth (Cristian Ciocaltea)
- phy: freescale: Initialize priv-&gt;lock (Xiaolei Wang)
- phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (Christophe Jaillet)
- leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM (Fenglin Wu)
- mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- wifi: mac80211: fix CMAC functions not handling errors (Chien Wong)
- iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb (Aashish Sharma)
- scsi: qla2xxx: Fix improper freeing of purex item (Zilin Guan) [Orabug: 38798928] {CVE-2025-68741}
- pwm: bcm2835: Make sure the channel is enabled after pwm_request() (Uwe Kleine-König)
- perf arm_spe: Fix memset subclass in operation (Leo Yan)
- perf arm-spe: Extend branch operations (Leo Yan)
- ipv6: clear RA flags when adding a static route (Fernando Fernandez Mancera)
- drm/msm/a6xx: Improve MX rail fallback in RPMH vote init (Akhil P Oommen)
- drm/msm/a6xx: Fix the gemnoc workaround (Akhil P Oommen)
- drm/msm/a6xx: Flush LRZ cache before PT switch (Akhil P Oommen)
- drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (Jay Liu)
- fs/ntfs3: Prevent memory leaks in add sub record (Edward Adam Davis)
- fs/ntfs3: out1 also needs to put mi (Edward Adam Davis)
- powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format (Ritesh Harjani)
- powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit (Ritesh Harjani)
- bpf: Fix invalid prog-&gt;stats access when update_effective_progs fails (Pu Lehui) [Orabug: 38798931] {CVE-2025-68742}
- wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (Abdun Nihaal) [Orabug: 38818221] {CVE-2025-68759}
- drm/msm/a2xx: stop over-complaining about the legacy firmware (Dmitry Baryshkov)
- block/blk-throttle: Fix throttle slice time for SSDs (Guenter Roeck)
- NFSD/blocklayout: Fix minlength check in proc_layoutget (Sergey Bashirov)
- tracefs: fix a leak in eventfs_create_events_dir() (Al Viro)
- watchdog: starfive: Fix resource leak in probe error path (Xu Wang)
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (Xu Wang)
- bpf: Check skb-&gt;transport_header is set in bpf_skb_check_mtu (Martin Kafai Lau) [Orabug: 38798820] {CVE-2025-68363}
- selftests/bpf: Fix failure paths in send_signal test (Alexei Starovoitov)
- bpf: Handle return value of ftrace_set_filter_ip in register_fentry (Menglong Dong)
- ps3disk: use memcpy_{from,to}_bvec index (René Rebe)
- drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype (Dmitry Baryshkov)
- crypto: iaa - Fix incorrect return value in save_iaa_wq() (Zilin Guan)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C (Fukaumi Naoki)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A (Fukaumi Naoki)
- arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A (Fukaumi Naoki)
- PCI: keystone: Exit ks_pcie_probe() for invalid mode (Siddharth Vadapalli)
- bpf: Free special fields when update [lru_,]percpu_hash maps (Leon Hwang) [Orabug: 38798936] {CVE-2025-68744}
- leds: netxbig: Fix GPIO descriptor leak in error paths (Xu Wang)
- scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls (Xu Wang)
- ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (Xu Wang)
- ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() (Dmitry Antipov) [Orabug: 38798823] {CVE-2025-68364}
- lib/vsprintf: Check pointer before dereferencing in time_and_date() (Andy Shevchenko)
- clk: renesas: r9a06g032: Fix memory leak in error path (Xu Wang)
- coresight: etm4x: Add context synchronization before enabling trace (Leo Yan)
- coresight: etm4x: Extract the trace unit controlling (Leo Yan)
- coresight: etm4x: Correct polling IDLE bit (Leo Yan)
- coresight: Change device mode to atomic type (Leo Yan)
- nbd: defer config unlock in nbd_genl_connect (Zheng Qixing) [Orabug: 38798832] {CVE-2025-68366}
- wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (Abdun Nihaal)
- macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (Long Li) [Orabug: 38798837] {CVE-2025-68367}
- powerpc/32: Fix unpaired stwcx. on interrupt exit (Christophe Leroy)
- powerpc/kdump: Fix size calculation for hot-removed memory ranges (Sourabh Jain)
- cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs (Gautham R. Shenoy)
- scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() (Bean Huo)
- drm/panthor: Fix potential memleak of vma structure (Akash Goel)
- ntfs3: init run lock for extend inode (Edward Adam Davis)
- ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties (Jihed Chaibi)
- RDMA/rtrs: server: Fix error handling in get_or_create_srv (Ma Ke)
- dt-bindings: PCI: amlogic: Fix the register name of the DBI region (Manivannan Sadhasivam)
- scsi: smartpqi: Fix device resources accessed after device removal (Mike Mcgowen) [Orabug: 38798847] {CVE-2025-68371}
- scsi: stex: Fix reboot_notifier leak in probe error path (Xu Wang)
- nbd: defer config put in recv_work (Zheng Qixing) [Orabug: 38798850] {CVE-2025-68372}
- md: fix rcu protection in md_wakeup_thread (Yun Zhou) [Orabug: 38798857] {CVE-2025-68374}
- regulator: core: disable supply if enabling main regulator fails (Gabor Juhos)
- perf/x86/intel: Correct large PEBS flag check (Dapeng Mi)
- ext4: correct the checking of quota files before moving extents (Zhang Yi)
- mfd: da9055: Fix missing regmap_del_irq_chip() in error path (Xu Wang)
- locktorture: Fix memory leak in param_set_cpumask() (Wang Liang)
- efi/libstub: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- x86/boot: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels (Yegor Yefremov)
- libbpf: Fix parsing of multi-split BTF (Alan Maguire)
- spi: tegra210-quad: Fix timeout handling (Vishwaroop A) [Orabug: 38798943] {CVE-2025-68746}
- drm/panthor: Fix UAF on kernel BO VA nodes (Boris Brezillon)
- drm/panthor: Fix race with suspend during unplug (Ketil Johnsen)
- drm/panthor: Fix UAF race between device unplug and FW event processing (Ketil Johnsen)
- drm/panthor: Fix group_free_queue() for partially initialized queues (Boris Brezillon)
- drm/panthor: Handle errors returned by drm_sched_entity_init() (Boris Brezillon)
- fs/9p: Don't open remote file with APPEND mode when writeback cache is used (Tingmao Wang)
- scsi: target: Do not write NUL characters into ASCII configfs output (Bart Van Assche)
- power: supply: apm_power: only unset own apm_get_power_status (Ahelenia Ziemiańska)
- power: supply: wm831x: Check wm831x_set_bits() return value (Ivan Abramov)
- power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (Murad Masimov)
- power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (Ivan Abramov)
- power: supply: max17040: Check iio_read_channel_processed() return code (Ivan Abramov)
- power: supply: cw2015: Check devm_delayed_work_autocancel() return code (Ivan Abramov)
- power: supply: rt5033_charger: Fix device node reference leaks (Xu Wang)
- perf record: skip synthesize event when open evsel failed (Shuai Xue)
- perf lock contention: Load kernel map before lookup (Namhyung Kim)
- drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() (Geert Uytterhoeven)
- interconnect: debugfs: Fix incorrect error handling for NULL path (Kuan-Wei Chiu)
- arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller (Dmitry Baryshkov)
- interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS (Dmitry Baryshkov)
- wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() (Abdun Nihaal)
- i3c: master: svc: Prevent incomplete IBI transaction (Stanley Chu)
- i3c: fix refcount inconsistency in i3c_master_register (Frank Li)
- pinctrl: stm32: fix hwspinlock resource leak in probe function (Xu Wang)
- soc: qcom: smem: fix hwspinlock resource leak in probe error paths (Xu Wang)
- tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set (Benjamin Berg)
- x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() (Tengda Wu)
- task_work: Fix NMI race condition (Peter Zijlstra)
- perf/x86/intel/cstate: Remove PC3 support from LunarLake (Zhang Rui)
- bpf: Fix stackmap overflow check in __bpf_get_stackid() (Arnaud Lecomte) [Orabug: 38798864] {CVE-2025-68378}
- bpf: Refactor stack map trace depth calculation into helper function (Arnaud Lecomte)
- perf: Remove get_perf_callchain() init_nr argument (Josh Poimboeuf)
- mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (Xu Wang)
- mtd: nand: relax ECC parameter validation check (Aryan Srivastava)
- Revert "mtd: rawnand: marvell: fix layouts" (Aryan Srivastava)
- ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties (Wolfram Sang)
- ARM: dts: renesas: gose: Remove superfluous port property (Wolfram Sang)
- RDMA/rxe: Fix null deref on srq-&gt;rq.queue after resize failure (Zhu Yanjun) [Orabug: 38798867] {CVE-2025-68379}
- sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Kuniyuki Iwashima)
- phy: mscc: Fix PTP for VSC8574 and VSC8572 (Horatiu Vultur)
- arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory (Alexander Martinz)
- arm64: dts: qcom: sm8650: set ufs as dma coherent (Neil Armstrong)
- arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider (Gergo Koteles)
- arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller (Krishna Kurapati)
- arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller (Krishna Kurapati)
- firmware: imx: scu-irq: fix OF node leak in (Peng Fan)
- arm64: dts: ti: k3-am62p: Fix memory ranges for GPU (Randolph Sapp)
- s390/ap: Don't leak debug feature files if AP instructions are not available (Heiko Carstens)
- s390/smp: Fix fallback CPU detection (Heiko Carstens)
- wifi: ath11k: fix peer HE MCS assignment (Baochen Qiang) [Orabug: 38798872] {CVE-2025-68380}
- wifi: ath11k: fix VHT MCS assignment (Baochen Qiang)
- crypto: hisilicon/qm - restore original qos values (Nieweiqiang)
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (Thorsten Blum) [Orabug: 38798874] {CVE-2025-68724}
- soc: qcom: gsbi: fix double disable caused by devm (Xu Wang)
- soc: Switch back to struct platform_driver::remove() (Uwe Kleine-König)
- clk: qcom: camcc-sm7150: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (Li Qiang)
- PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (Geert Uytterhoeven)
- arm64: dts: exynos: gs101: fix sysreg_apm reg property (Peter Griffin)
- perf annotate: Check return value of evsel__get_arch() properly (Tianyou Li)
- arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 (Tim Harvey)
- arm64: dts: imx8mp-venice-gw702x: remove off-board uart (Tim Harvey)
- arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl (Tim Harvey)
- arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props (Tim Harvey)
- block/mq-deadline: Switch back to a single dispatch list (Bart Van Assche)
- block/mq-deadline: Introduce dd_start_request() (Bart Van Assche)
- firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc (Randy Dunlap)
- iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (Francesco Lavra)
- inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() (Luoxuanqiang)
- inet: Avoid ehash lookup race in inet_ehash_insert() (Luoxuanqiang)
- rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() (Luoxuanqiang)
- clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets (Stephan Gerhold)
- ntfs3: Fix uninit buffer allocated by __getname() (Sidharth Seela)
- ntfs3: fix uninit memory after failed mi_read in mi_format_new (Raphael Pinsonneault-Thibeault)
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Herbert Xu)
- irqchip/qcom-irq-combiner: Fix section mismatch (Johan Hovold)
- irqchip/starfive-jh8100: Fix section mismatch (Johan Hovold)
- irqchip/renesas-rzg2l: Fix section mismatch (Johan Hovold)
- irqchip/imx-mu-msi: Fix section mismatch (Johan Hovold)
- irqchip/irq-brcmstb-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7120-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7038-l1: Fix section mismatch (Johan Hovold)
- sched/fair: Forfeit vruntime on yield (Fernand Sieber)
- wifi: ath11k: restore register window after global reset (Baochen Qiang)
- wifi: ath10k: move recovery check logic into a new work (Kang Yang)
- wifi: ath10k: Add missing include of export.h (Jeff Johnson)
- wifi: ath10k: Avoid vdev delete timeout when firmware is already down (Loic Poulain)
- objtool: Fix weak symbol detection (Josh Poimboeuf)
- objtool: Fix standalone --hacks=jump_label (Dylan Hatch)
- HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (Mavroudis Chatzilazaridis)
- drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() (Cyrille Pitchen)
- clk: renesas: cpg-mssr: Read back reset registers to assure values latched (Marek Vasut)
- clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register (Thierry Bultel)
- clk: renesas: Use str_on_off() helper (Geert Uytterhoeven)
- clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (Marek Vasut)
- pinctrl: renesas: rzg2l: Fix PMC restore (Biju Das)
- USB: Fix descriptor count when handling invalid MBIM extended descriptor (Seungjin Bae)
- drm/vgem-fence: Fix potential deadlock on release (Janusz Krzysztofik) [Orabug: 38818211] {CVE-2025-68757}
- accel/ivpu: Fix DCT active percent format (Karol Wachowski)
- accel/ivpu: Make function parameter names consistent (Jacek Lawrynowicz)
- drm/panel: visionox-rm69299: Don't clear all mode flags (Guido Günther)
- accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail (Karol Wachowski)
- accel/ivpu: Prevent runtime suspend during context abort work (Andrzej Kacprowski)
- gpu: host1x: Fix race in syncpt alloc/free (Mainak Sen) [Orabug: 38798898] {CVE-2025-68732}
- smack: fix bug: setting task label silently ignores input garbage (Konstantin Andreev)
- smack: fix bug: unprivileged task can create labels (Konstantin Andreev)
- smack: fix bug: invalid label of unix socket file (Konstantin Andreev)
- smack: always "instantiate" inode in smack_inode_init_security() (Konstantin Andreev)
- smack: deduplicate xattr setting in smack_inode_init_security() (Konstantin Andreev)
- smack: fix bug: SMACK64TRANSMUTE set on non-directory (Konstantin Andreev)
- smack: deduplicate "does access rule request transmutation" (Konstantin Andreev)
- net/mlx5e: Set default burst period for TX and RX reporters (Shahar Shitrit) [Orabug: 38636804]
- devlink: Make health reporter burst period configurable (Shahar Shitrit) [Orabug: 38636804]
- devlink: Introduce burst period for health reporter (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move health reporter recovery abort logic to a separate function (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move graceful period parameter to reporter ops (Shahar Shitrit) [Orabug: 38636804]
- devlink: use devlink_nl_put_u64() helper (Przemek Kitszel) [Orabug: 38636804]
- devlink: introduce devlink_nl_put_u64() (Przemek Kitszel) [Orabug: 38636804]
- Revert "net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery" (Qing Huang) [Orabug: 38636804]
- net/rds: improve conn destroy printk message (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: expand kref coverage to rds_notifier-&gt;n_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: rds_sendmsg must use rs_conn only when not being destroyed (Sharath Srinivasan) [Orabug: 38728742]
- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang) [Orabug: 38766139]
- mm: list_lru: avoid using NULL list_lru_one. (Imran Khan) [Orabug: 38787957]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg)
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa)
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn)
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe)
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping)
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen)
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan)
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo) [Orabug: 38847806] {CVE-2025-68789}
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera)
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38649136]  {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.1.el10uek]" date="1769688000">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang)  [Orabug: 38899652]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.2.el10uek]" date="1770897600">- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan)  [Orabug: 38937451]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.3.el10uek]" date="1771329600">- net/rds: Fix issue with a revert in rds_send_queue_rm (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
</package>
<package pkgid="656f7c02c8e28fd5391954c8f0aeccf4a3898a55" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="109.67.6.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg) [Orabug: 38887626] {CVE-2025-71156}
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa) [Orabug: 38887628] {CVE-2025-71157}
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn) [Orabug: 38887618] {CVE-2025-71154}
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe) [Orabug: 38887603] {CVE-2025-71149}
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping) [Orabug: 38887600] {CVE-2025-71148}
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen) [Orabug: 38887596] {CVE-2025-71147}
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan) [Orabug: 38887608] {CVE-2025-71151}
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo)
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera) [Orabug: 38887785] {CVE-2025-71146}
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.6.el10uek]" date="1772884800">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong)  [Orabug: 39027305]</changelog>
</package>
<package pkgid="5f3b91ad98c042233cf00dc7848dbcf51eaa0fd2" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315]</changelog>
</package>
<package pkgid="3f73406a465362754f9126e0a74a112b98cbe0c1" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-200.74.27.2.el10uek]" date="1775649600">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39186444]  {CVE-2025-40135} 
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39181102]  {CVE-2026-23231} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39181101]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="d3b2b635f3909cfcf5a446890e6104a4e5458bb3" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]  
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]  
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
</package>
<package pkgid="68c6d12836fd21a5c7793b0b8f5511e776484a65" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]  
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]  
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="24f78e9b95004f1dc943fb2a59aebb0ade65c486" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]  
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]  
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431} 
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]  
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]  
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]  
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
</package>
<package pkgid="b1c973046e226a92bf19595939e7d50711e1f13b" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-201.74.2.3.el10uek]" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39342689]  {CVE-2026-43500} 
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39342689]  
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39342689]  
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39342689]  
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39342689]  {CVE-2026-43284}</changelog>
</package>
<package pkgid="6da5acca4f61fb2b5c638b1d0861a47d9f45dcfa" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck)
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park)
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong)
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck)
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu)
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong)
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N)
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He)
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin)
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian)
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko)
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu)
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N)
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo)
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement)
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K)
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen)
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy)
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle)
- kexec: derive purgatory entry from symbol (Li Chen)
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao)
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez)
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey)
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang)
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev)
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong)
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong)
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson)
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo)
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig)
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav)
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed)
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang)
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao)
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal)
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal)
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li)
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li)
- media: radio-keene: fix memory leak in error path (Shaurya Rane)
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack)
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack)
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack)
- HID: hid-pl: handle probe errors (Oliver Neukum)
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson)
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers)
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han)
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian)
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski)
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu)
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni)
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo)
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi)
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo)
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa)
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen)
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai)
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt)
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov)
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal)
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li)
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni)
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek)
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui)
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith)
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith)
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai)
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan)
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan)
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus)
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook)
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek)
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin)
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu)
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao)
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi)
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen)
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang)
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li)
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab)
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab)
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab)
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab)
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang)
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho)
- gfs2: fiemap page fault fix (Andreas Gruenbacher)
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang)
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn)
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150]
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116]
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972]
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500} 
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]  
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513]  
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]  
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]  
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]  
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284} 
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
</package>
<package pkgid="f1366700f541706280f6dd8e185018baf188bfd8" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974] {CVE-2026-43129}
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270} 
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278} 
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
</package>
<package pkgid="992b6ab8ab9c5ac0df7daa6fc624e17cc5c6d840" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278}
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-202.76.4.3.el10uek]" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391434]  {CVE-2026-46333}</changelog>
</package>
<package pkgid="cddbd8f78999bdf61fbf0c67e926e257b54ffcf5" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278}
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-202.76.4.3.el10uek]" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391434]  {CVE-2026-46333}</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.4.el10uek]" date="1779364800">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39420559]  {CVE-2026-46300} 
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39420559]</changelog>
</package>
<package pkgid="4b732333ad890c4ce19ecdfb9105ef05bbe78f56" name="kernel-uek-debug-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="203.76.7.1.el10uek"/>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) [Orabug: 39227772] {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) [Orabug: 39251164] {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) [Orabug: 39251169] {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) [Orabug: 39262447] {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) [Orabug: 39331678] {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) [Orabug: 39331784] {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) [Orabug: 39300554] {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) [Orabug: 39331889] {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) [Orabug: 39331303] {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) [Orabug: 39331577] {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) [Orabug: 39339241] {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) [Orabug: 39343623] {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) [Orabug: 39331924] {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) [Orabug: 39331696] {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) [Orabug: 39331680] {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) [Orabug: 39331661] {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) [Orabug: 39331512] {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) [Orabug: 39331937] {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) [Orabug: 39331435] {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) [Orabug: 39331422] {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) [Orabug: 39343538] {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) [Orabug: 39331504] {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) [Orabug: 39331827] {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) [Orabug: 39343546] {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) [Orabug: 39331482] {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) [Orabug: 39331693] {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) [Orabug: 39331458] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) [Orabug: 39331580] {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) [Orabug: 39331409] {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) [Orabug: 39331341] {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) [Orabug: 39331444] {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) [Orabug: 39331510] {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) [Orabug: 39331358] {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) [Orabug: 39331954] {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) [Orabug: 39331545] {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) [Orabug: 39331821] {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) [Orabug: 39331705] {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) [Orabug: 39331366] {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) [Orabug: 39331866] {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) [Orabug: 39331752] {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) [Orabug: 39331370] {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) [Orabug: 39331846] {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) [Orabug: 39331389] {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) [Orabug: 39331440] {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) [Orabug: 39343613] {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) [Orabug: 39331353] {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) [Orabug: 39331023] {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) [Orabug: 39331012] {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) [Orabug: 39331761] {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) [Orabug: 39331606] {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) [Orabug: 39331628] {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) [Orabug: 39331331] {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) [Orabug: 39331449] {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) [Orabug: 39331361] {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) [Orabug: 39331875] {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) [Orabug: 39331549] {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) [Orabug: 39331496] {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) [Orabug: 39331383] {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) [Orabug: 39331959] {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) [Orabug: 39343626] {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [Orabug: 39343577] {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) [Orabug: 39331591] {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) [Orabug: 39343531] {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) [Orabug: 39331853] {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) [Orabug: 39331859] {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) [Orabug: 39343609] {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) [Orabug: 39331003] {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) [Orabug: 39343515] {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) [Orabug: 39331318] {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) [Orabug: 39331375] {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) [Orabug: 39343527] {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) [Orabug: 39331585] {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) [Orabug: 39343616] {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) [Orabug: 39331719] {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) [Orabug: 39331807] {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) [Orabug: 39343628] {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) [Orabug: 39331070] {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) [Orabug: 39331308] {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) [Orabug: 39343581] {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) [Orabug: 39331918] {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) [Orabug: 39343603] {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) [Orabug: 39331896] {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) [Orabug: 39331636] {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) [Orabug: 39331947] {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) [Orabug: 39331518] {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) [Orabug: 39331877] {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) [Orabug: 39331789] {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) [Orabug: 39331882] {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) [Orabug: 39331312] {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) [Orabug: 39331077] {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 38649060,39186444,39202432] {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet) [Orabug: 38887740,39181101,39202431] {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera) [Orabug: 39029337,39131054] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe) [Orabug: 39144150,39343763] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao) [Orabug: 38970584,39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A) [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu) [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu) [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu) [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu) [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu) [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski) [Orabug: 39166116]</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.1.el10uek]" date="1776772800">- Revert "EDAC: Octeon: Init SDEI" (Jeremy Tang) [Orabug: 39203407]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.2.el10uek]" date="1777464000">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman) [Orabug: 39276980]
- uek-rpm/config-aarch64: Enable NVIDIA-recommended Vera-Rubin configs (Vijay Kumar) [Orabug: 39157707]
- kselftest/arm64: Add HWCAP test for FEAT_LS64 (Yicong Yang) [Orabug: 39157707]
- arm64: Provide basic EL2 setup for FEAT_{LS64, LS64_V} usage at EL0/1 (Yicong Yang) [Orabug: 39157707]
- perf: arm_spe: Relax period restriction (Leo Yan) [Orabug: 39157707]
- perf/arm_cspmu: Add PMEVFILT2R support (Robin Murphy) [Orabug: 39157707]
- ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional (Lifeng Zheng) [Orabug: 39157707]
- dt-bindings: gpio: Add Tegra256 support (Prathamesh Shete) [Orabug: 39157707]
- perf/arm_cspmu: nvidia: Add revision id matching (Besar Wicaksono) [Orabug: 39157707]
- arm64: Handle BRBE booting requirements (Anshuman Khandual) [Orabug: 39157707]
- arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again (Rob Herring) [Orabug: 39157707]
- arm64/gcs: Provide basic EL2 setup to allow GCS usage at EL0 and EL1 (Mark Brown) [Orabug: 39157707]
- tools headers arm64: Add NVIDIA Olympus part (Besar Wicaksono) [Orabug: 39157707]
- perf arm-spe: Add NVIDIA Olympus to neoverse list (Besar Wicaksono) [Orabug: 39157707]
- perf arm_spe: Add CPU variants supporting common data source packet (Leo Yan) [Orabug: 39157707]
- arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Yicong Yang) [Orabug: 39157707]
- perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Yicong Yang) [Orabug: 39157707]
- perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions (Yicong Yang) [Orabug: 39157707]
- perf/arm_cspmu: nvidia: Add pmevfiltr2 support (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Add pmpidr support (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Move register definitons to header (Robin Murphy) [Orabug: 39157707]
- perf/arm_cspmu: Add callback to reset filter config (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Generalise event filtering (Robin Murphy) [Orabug: 39157707]
- perf: arm_pmuv3: Add support for the Branch Record Buffer Extension (BRBE) (Rob Herring) [Orabug: 39157707]
- arm64/sysreg: Add BRBE registers and fields (Anshuman Khandual) [Orabug: 39157707]
- perf: arm_pmu: Move PMUv3-specific data (Mark Rutland) [Orabug: 39157707]
- perf: apple_m1: Don't disable counter in m1_pmu_enable_event() (Rob Herring) [Orabug: 39157707]
- perf: arm_v7_pmu: Don't disable counter in (armv7|krait_|scorpion_)pmu_enable_event() (Rob Herring) [Orabug: 39157707]
- perf: arm_v7_pmu: Drop obvious comments for enabling/disabling counters and interrupts (Rob Herring) [Orabug: 39157707]
- perf: arm_pmuv3: Don't disable counter in armv8pmu_enable_event() (Mark Rutland) [Orabug: 39157707]
- ACPI: CPPC: Rename EPP constants for clarity (Sumit Gupta) [Orabug: 39157707]
- ACPI: CPPC: Add three functions related to autonomous selection (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel() (Lifeng Zheng) [Orabug: 39157707]
- cpufreq/amd-pstate: Store the boost numerator as highest perf again (Mario Limonciello) [Orabug: 39157707]
- ACPI: CPPC: Refactor register value get and set ABIs (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Add cppc_set_reg_val() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Extract cppc_get_reg_val_in_pcc() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Optimize cppc_get_perf() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu() (Jie Zhan) [Orabug: 39157707]
- ACPI: CPPC: Clean up cppc_perf_caps and cppc_perf_ctrls structs (Sumit Gupta) [Orabug: 39157707]
- cpufreq: CPPC: Add generic helpers for sysfs show/store (Sumit Gupta) [Orabug: 39157707]
- cpufreq: CPPC: Add support for autonomous selection (Lifeng Zheng) [Orabug: 39157707]
- PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (Nirmoy Das) [Orabug: 39157707]
- PCI: Add ASPEED vendor ID to pci_ids.h (Nirmoy Das) [Orabug: 39157707]
- i2c: tegra: Add support for SW mutex register (Kartik) [Orabug: 39157707]
- i2c: tegra: Use internal reset when reset property is not available (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add HS mode support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Update Tegra256 timing parameters (Akhil R) [Orabug: 39157707]
- i2c: tegra: Use separate variables for fast and fastplus (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add Tegra264 support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add Tegra256 support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Do not configure DMA if not supported (Kartik) [Orabug: 39157707]
- gpio: tegra186: Fix GPIO name collisions for Tegra410 (Kartik) [Orabug: 39157707]
- gpio: tegra186: Use generic macro for port definitions (Kartik) [Orabug: 39157707]
- gpio: tegra186: Add support for Tegra410 (Prathamesh Shete) [Orabug: 39157707]
- gpio: tegra186: Add support for Tegra256 (Prathamesh Shete) [Orabug: 39157707]
- arm64: acpi: Enable ACPI CCEL support (Suzuki K Poulose) [Orabug: 39157707]
- arm64: Enable EFI secret area Securityfs support (Suzuki K Poulose) [Orabug: 39157707]
- arm64: realm: ioremap: Allow mapping memory as encrypted (Suzuki K Poulose) [Orabug: 39157707]
- arm64: Document Arm Confidential Compute (Steven Price) [Orabug: 39157707]
- virt: arm-cca-guest: TSM_REPORT support for realms (Sami Mujawar) [Orabug: 39157707]
- arm64: Enable memory encrypt for Realms (Suzuki K Poulose) [Orabug: 39157707]
- arm64: mm: Avoid TLBI when marking pages as valid (Steven Price) [Orabug: 39157707]
- arm64: Enforce bounce buffers for realm DMA (Steven Price) [Orabug: 39157707]
- efi: arm64: Map Device with Prot Shared (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Map unprotected MMIO as decrypted (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Add support for checking whether an MMIO is protected (Suzuki K Poulose) [Orabug: 39157707]
- arm64: realm: Query IPA size from the RMM (Steven Price) [Orabug: 39157707]
- arm64: Detect if in a realm and set RIPAS RAM (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Add RSI definitions (Suzuki K Poulose) [Orabug: 39157707]
- PCI/TPH: Add TPH documentation (Wei Huang) [Orabug: 39157707]
- PCI/TPH: Add Steering Tag support (Wei Huang) [Orabug: 39157707]
- PCI: Add TLP Processing Hints (TPH) support (Wei Huang) [Orabug: 39157707]
- sched: Update rq-&gt;avg_idle when a task is moved to an idle CPU (Shubhang Kaushik) [Orabug: 39214522]
- arm64: mte: Set TCMA1 whenever MTE is present in the kernel (Carl Worth) [Orabug: 39214522]
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov) [Orabug: 39241227,39273721] {CVE-2026-31628}
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp) [Orabug: 39252919]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp) [Orabug: 39259550]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.3.el10uek]" date="1777982400">- sched/deadline: Use revised wakeup rule for dl_server (Peter Zijlstra)
- netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [Orabug: 39339273] {CVE-2026-43084}
- netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -&gt; GFP_KERNEL_ACCOUNT allocation (Scott Mitchell)
- Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt" (Sasha Levin)
- Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads" (Sasha Levin)
- iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() (Zhen Ni) [Orabug: 39145066]
- iommu/amd: Fix header file (Vasant Hegde) [Orabug: 39145066]
- iommu/amd: Preserve default DTE fields when updating Host Page Table Root (Alejandro Jimenez) [Orabug: 39145066]
- iommu/amd: Enable support for up to 2K interrupts per function (Kishon Vijay Abraham I) [Orabug: 39145066]
- iommu/amd: Rename DTE_INTTABLEN* and MAX_IRQS_PER_TABLE macro (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Replace slab cache allocator with page allocator (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Introduce generic function to set multibit feature value (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Remove amd_iommu_apply_erratum_63() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Lock DTE before updating the entry with WRITE_ONCE() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Modify clear_dte_entry() to avoid in-place update (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce helper function get_dte256() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Modify set_dte_entry() to use 256-bit DTE helpers (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce helper function to update 256-bit DTE (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce struct ivhd_dte_flags to store persistent DTE flags (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Misc ACPI IVRS debug info clean up (Suravee Suthikulpanit) [Orabug: 39145066]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39250685,39331108] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [Orabug: 39250685]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug: 39250685,39300909] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250685]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le) [Orabug: 39250685]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug: 39250685,39283866,39291972,39292190] {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250685]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers) [Orabug: 39250685]
- iommu/arm-smmu-v3: Handle zeroed A4-2C HTTU override settings (Joao Martins) [Orabug: 39260974]</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.4.el10uek]" date="1778587200">- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39218893]  {CVE-2025-54518}
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39334587]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39334587]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39334587]
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39334587]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39334587]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39334587]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39334587]  {CVE-2026-43284}
- bcm-hsdk-gpl: Fix build issues for HSDK 6.5.34 (Vijay Kumar)  [Orabug: 39342234]
- bcm-hsdk-gpl: Update BCM HSDK GPL driver to 6.5.34 (Vijay Kumar)  [Orabug: 39342234]
- minke-fan-cpld: Avoid logging 'unknown fan id' when no fan is present (arista-hpandya)  [Orabug: 39335238]
- exadata: tools: perf: update column to comm_nodigit (Stephen Brennan)  [Orabug: 39327035]
- perf report: Add comm_nodigit sort key (Stephen Brennan)  [Orabug: 39327035]
- Revert "tools: perf: add comm_ignore_digit column" (Stephen Brennan)  [Orabug: 39327035]
- octeontx2-af: cn20k: Fix RVU AF interrupt handler (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Move QMEM allocations from GFP_KERNEL to ATOMIC (Sunil Goutham)  [Orabug: 39318904]
- bphy-pf: CNF20Ka: poll MHABs based on cpri_mask instead of fixed count (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: Add devlink param for NIX RQ caching (Nishok A)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix the RVUAF-&gt;PF mbox address (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add devlink and debugfs support for NPA DWRR registers. (Anshumali Gaur)  [Orabug: 39318904]
- cn20k-af: psw: Fix build warning (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix AI review comments. (Ratheesh Kannoth)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox to write to PSW MSIX registers (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add debugfs support for psw (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: introduce a mailbox to program PSW mbox msix vector (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add PSW AF API Notification queue support (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add FLR handler for PSW (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setup PSW timed polling structure tables (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW PCIe configuration (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW LF mapping (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add new mailbox for PSW doorbell configuration (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setups PSW FID resources (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setup PSW GID resources (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox to get PSW capabilities (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: register PSW AF interrupts (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: introduce PSW block (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: limit max periodic timers for cn20k (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Make default entries as x4. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeonxt2-af: npc: Fix bugs (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2_unregister_dl() after kernel reboot. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2vf_remove after kernel reboot. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: cn20k: Configure default CPT_AF_UCC_CTL for IPsec error codes (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: CN20k: add support for RFOE4 on half MP (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: Fix kernel crash during eswitch creation (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Use ZERO_OR_NULL_PTR for cgxchan2link_map (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add parser configuration for VLAN extraction (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support for single SBTAG parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix SDP channel base (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add MCS DSA tag parsing configuration support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Avoid any false positives for Altaf (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npc: Fix broadcast MCAM entry type on CN10K (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add platform check. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-bphy-netdev: add get_link_ksettings to fix SIOCETHTOOL error (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: dont free default mcam indexes (Ratheesh Kannoth)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Replace deprecated MSI-X API in CPRI netdev driver (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix kernel warn. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Mismatch stats. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Dont free PF default mcam indexes. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: FIx invalid access (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: dstats (Ratheesh Kannoth)  [Orabug: 39318904]
- octeonxt2-af: npc: cn20k: show enable/disable status. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: debugfs for virtual indexes (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix AI reviews (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Alloc default indexes during nix lf alloc (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix default mcam idx free (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: Remove SoC specific local variables. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix SC resource cleanup loop (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs: Add SC CAM bypass entry (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Modify the pcifunc VF mask (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: update the AFPFX_TRIGX reg offset (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: Fix rvu mbox registers offset (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2: sdp: Display backpressure status in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: add bounds check in nix_bp_enable (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: cn20k: Set a default value for res_meta_offset (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: Support mapping of individual slots to RVU block LFs (Subbaraya Sundeep)  [Orabug: 39318904]
- cn20k-af: ml: improve AF register access control (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: fetch list of LF IDs attached (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: fix using uninitialized partition ID (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable mapping LF to partition ID (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable mapping LF with partitions (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support ML lf alloc and free (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support fetching msix offset for ML (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support attach and detach of ML LFs (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: add support to fetch ML capabilities (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: implement ML mbox message handler (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: register ML interrupt handlers (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: implement hw resource setup and free (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable ML block probe and remove (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: add skeleton code for ML EB driver (Prince Takkar)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Add CN20K TX SecY policy bit support (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs: Set default mcs Id to 0. (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix memleak in npc_install flow (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix flags for HWWQE period timers (Mikko Suni)  [Orabug: 39318904]
- octeontx2-af: cn20k: Use physical address for AF-&gt;PF mbox (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: update fields of CPT_AF_LFX_CTL (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: cn20k: configure RX inline replay (Shashank Gupta)  [Orabug: 39318904]
- Octeontx2-af: cn20k: configure inline RQ mask (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Don't initialize ipsec queues for representor PF. (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-bphy-pf: CNF20ka: BPHY NIC PF driver for chiplet based BPHY NIX bypass mode (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: fix npc mbox structure defination (Mohit Kumar Parjapat)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Avoid SoC specific structures (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix get number of kw (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: cancel work before destroying wq. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx: switch: Fix compiler warnings. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: selftest: Use unique mbox ids (Linu Cherian)  [Orabug: 39318904]
- octeontx: pan: Disable WQ after unregister notifier (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Define new flag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix bugs. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Update mcam_idx for reply flow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Support ovs offloading (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Support mask as well for flow. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Pass tuple mask as well to flow. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Retrieve VLAN infor for L3 routing (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Add vlan tag as part of message (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Dont process events if switchdev is not up (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: make functions static (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix graceful shutdown. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Notify switchdev on NF table callback (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Support SNAT/DNAT routing (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Reject acceleration for invalid bridge (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Fix buffer overflow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix below kernel splat (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switchdev: Register for Route events. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switchdev: Forward route notifications. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switchdev: Add driver support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switchdev: L2 offload support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Remove devlink support for SDP VF NIC driver (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: Handle pool context address update in Aura context write (Ashwin Sekhar T K)  [Orabug: 39318904]
- octeontx2-af: CN20k: fix unused-function warning (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-pf: Move representor event handling into common file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix Rep link state sync up with PF/VFs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Fix DPC config mbox (Ashwin Sekhar T K)  [Orabug: 39318904]
- Octeontx2-pf: Fix transceiver details corruption (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: change GEN PF device ID (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20K: Fetch LBK supported channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix limiting SRIOV VF count logic (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: Fix KASAN slab-out-of-bounds error (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: Update irq affinity for mbox and flr (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add FLR/ME support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Fix possible memleak while mbox init (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Map alternative AF NIX_AF_GINT only for CN10K (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support to forward error interrupts to alt AF (Anil Kumar Reddy)  [Orabug: 39318904]
- octeontx2-af: Add support to forward flr to alternative AF (Anil Kumar Reddy)  [Orabug: 39318904]
- octeontx2-af: Update Alternative AF status (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: cn20k: Cleanup AF interrupt vector (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Do not hardcode AF bus number in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix rsrc_alloc debugfs file (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Add devlink option to reset MAC stats for debugging (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add devlink for defrag initiation (Ratheesh Kannoth)  [Orabug: 39318904]
- net: octeontx2: Fix coding style issues (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: Fix mcs string buffer size (Stefan Wiehler)  [Orabug: 39318904]
- octeontx2-af: Skip TM tree print for disabled SQs (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: debugfs: Add cn20k sdp rings info (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix kernel crash during NIX TM register dump (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: cpt: Add debug support for more than 64 engines. (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Update engine offset calculation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Add support to display "Autoneg" (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-vf: Set tc filter flag on vf netdev (Suman Ghosh)  [Orabug: 39318904]
- Octeontx2-pf: Update link mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-pf: Fix ethtool eeprom read logic (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: ethtool: Display physical connector type (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: restart interface when link settings are changed by user (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-sdpvf: Fix PTP options for SDP interfaces (Roy Franz)  [Orabug: 39318904]
- octeontx2-vf: Add partial ethtool support for SDP VFs (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Add page pool stats to ethtool (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Add missing changes in otx2_ethtool.c (Suman Ghosh)  [Orabug: 39318904]
- Octeontx2-pf: tc: fix egress ratelimiting (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Support to enable EDSA/Higig2 pkts parsing (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Using compound/head page ref count (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Fix NDC sync operation errors (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: cn20k: fix target address (Juan Garcia)  [Orabug: 39318904]
- octeontx2-pf: Check address for Null before free (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Add soft reset sequence in mcs_global_cfg() (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-pf: mcs: Don't account field alignment when installing TX SecY policy (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix start and end bit for scan config (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: npc: cn20k: Remove function (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: npc: cn20k: refactor code (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cgx: misc changes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: reset TL1 SW_XOFF before returning from link mode change (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Remove MAC address validation check (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Show count of dropped packets by DMAC filters (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Update mbox version (Sunil Goutham)  [Orabug: 39318904]
- cn10k-ipsec: Fix compilation with XFRM_OFFLOAD enabled (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-vf: Register dummy netdev for host PF VFs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Configure SQ default channel based on UP message (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Dereference only a valid pointer (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-vf: Fix VF mbox up message error on PTP RX enable (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: Add support for creating netdev interfaces for SDP VFs (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Add more debug messages (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Send UP messages to VF only when VF is up. (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Avoid null pointer dereference (Subbaraya Sundeep)  [Orabug: 39318904]
- cn10k-ipsec: fix uninitialized send queue during ESP offload (Shashank Gupta)  [Orabug: 39318904]
- cn10k-ipsec: Initialize ipsec queues on enabling IPsec (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: cn10k/cn20k: Update count_eot in NPA_LF_AURA_BATCH_FREE0 (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: persist netdev stats across routine operations (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-pf: Add self test (Linu Cherian)  [Orabug: 39318904]
- octeontx2-pf: Add ethtool -m option support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Skip dma map and unmap when IOMMU is bypassed (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-pf: Add NIXLF error/poison interrupt handlers (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-pf: Validation for TL1 Round robin priority (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: devlink param support to modify physical interface links. (Rakesh Babu)  [Orabug: 39318904]
- octeontx2-pf: Add devlink param to vary rbuf size (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Add devlink param to vary cqe size (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: CN20k: add multi chiplet support to NIX path (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Enable TX PTP timestamping on BPHY NIX link (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cn10k: Fix accessing invalid CSRs (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: fix fwdata NULL pointer dereference when RPM probe fails (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Map BPHY chiplet RPMs followed by compute chiplet RPMs (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Add chiplet RPM AF mbox support for port ready, get channel info messages. (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cnf20k: account for XCB RPM links in CGX link calculation (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Add support for chiplet based BPHY RPM driver as AF RVU extension block module (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Add BPHY chiplet, RPM, LMAC data to fwdata (Sai Krishna)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Register driver with PCI subsys ID (Anshumali Gaur)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Fix MSI-X init failure by setting both DMA masks (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20K: Add build and config support for CPRI PF driver to avoid module conflicts (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Fix CPRI MSI-X initialization failure (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Add workaround for gpint issue for CPRI pkt path (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Add cpri netdev driver support (Viswajith Murali)  [Orabug: 39318904]
- octeontx-bphy-netdev: Fix unexpected packet in netdev by ensuring proper PSW hardware write handling (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-bphy-netdev: allow forcing ts steps cnt (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix fec counters reporting (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix ecpri pkt stats update (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix ecpri type5 handling (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix a deadlock in cpri (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix race condition for timestamp packets (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix kernel crash by using proper max PSM queue count (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: protect psm queue access (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix debugfs memleak (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Detect DL circular buffer full (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix rsfec stats reading (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Support for eCPRI MsgType5 timestamping (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Use correct netdev priv structure for debugging (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: disable CPRI RX on cleanup (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: ignore mcs untagged error (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: disable rx on RFOEs on exit (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix crash issue during initialization of cpri, rfoe interfaces on set MAC address (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: OcteonTX2 Base PHY RFOE netdev driver (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver msix, interrupt handling (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Move DPI block reset handling to AF extension block driver (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver channel table mbox support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver mbox support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver initial support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cn20k: Don't reset the PF_DISC register (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: CN20K: update RPM links (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add block discovery register (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix PTP RX enable mbox fail issue over NIC VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Modify NIX register offset value for CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Validate NIX maximum LFs correctly (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix incorrect BPID initialization for CPT channels (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow CPT PF access to CPT_AF_GRPX_THR (Shashank Gupta)  [Orabug: 39318904]
- octeontx2-af: cn20k: support packet data buffer (pdb) configuration (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Set LBK channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix config parameter check when disable inline queue (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable CPT parse and Frag info header byte swap (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Add an MCAM entry to count CPT 2nd pass miss packets (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: support overriding aura to zero for second pass (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Use proper mask to get max CPT LF's (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: allow mbox access from CPT VFs for backward compatibility (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: Drop CPT PF/VF check for relevant mboxes (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Change CPT channels configuration (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow CPT PF access to CPTX_AF_CTX_PSP_TIMER_CTL (Shashank Gupta)  [Orabug: 39318904]
- octeontx2-af: cn20k: change CPT register address as per latest csr (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow access to CPT_AF_UCCX_CTL (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: CN20K channel configuration (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable RXC on inline inbound cptlf (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix RXC flush and cleanup sequence (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add CPT CTX flush support (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: fix CPT ctx flush (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: cn20k: Setup CPT reassembly Queue Configuration Register (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Move RXC specific functions (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: cn20k: handle multi-queue reassembly teardown (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for NIX RX inline configuration (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for CPT RX inline configuration (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for CPT RX queue allocation (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mbox to configure rx inline nixlf (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mbox to configure rx inline profile (Bharat Bhushan)  [Orabug: 39318904]
- crypto: octeontx2: Add new mailbox to set queue priority (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add rxc teardown support (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add queue id to rxc time config mbox (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add cpt stats mailbox support (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: add FLT interrupts (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: Unify HW interrupt APIs (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx-af: cpt: Get CPT PF number using PF Device ID (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Update max engine calculation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Add TC rules support for CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Set correct sequence for carrier off and tx queue stop (Suman Ghosh)  [Orabug: 39318904]
- octeontx2: Fix klockwork issues. (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Free queue memory allocated sq timestamp (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Check for DMAC extraction support before setting DMAC based hardware filter for a VF (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Move REP devlink APIs to separate file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix representor up notification events (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Use ews_rules value to update REP tcam rules (Geetha sowjanya)  [Orabug: 39318904]
- Octeontx2-af: Change args for rvu_get_pf (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add validation before accessing fwdata (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: map management port always to first PF (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: replace generic error codes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: link mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Assign CGX id from PCI revision id (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Remove MAC address validation check (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: lmac validation with is_lmac_valid (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix compilation warning/klockwork issues (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: configure 802.3 pause frames in SGMII/QSGMII mode (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add new CGX_CMDs to set and get PHY modulation type (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Do not allow VFs to overwrite PKIND config (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Put CGX LMAC also in Higig2 mode (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-sdp: Add FLR interrupts for Host PFs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Refactor SDP interrupts code (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Fix SDP channel numbers in NPC rules (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Check whether SDP block is present before access (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: sdp: Fix address range assignment logic (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: sdp: Maintain host to RVU GEN PF mapping (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: misc SDP fixes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx-af: cn20k: Manage rings allocation and freeing (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: CN20K: SDP mbox framework (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: CN20K: SDP extension driver (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-pf: enable AF_XDP zero copy support (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix clearing TL3_TL2X_LINKX_CFG[ENA] during SMQ flush to drop packets (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Fix ROCEV2 RSS hashing QP ID length (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Allow to set CPT result address offset (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for NIX flow vector configuration (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: add ROCEv2 header for RSS hashing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Update lbk maximum frame size as per CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: fix TX scheduler count (Satha Rao)  [Orabug: 39318904]
- octeontx2-af: Fix the issue of infinite loop in nix_aq_reset (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Misc changes in NIX block (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Dump hw register state on error (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add new mailbox to configure LSO alt flags (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Extend SPI to SA index translation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: notify VF about ptp event (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: Sending tsc value to the userspace (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: Support for PTP notification to PF (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: npa: fix DPC permit register access (Ashwin Sekhar T K)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add DPC support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add debugfs support for Halo (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add NPA Halo support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Fix number of entries in the kpu3 cam (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix subbank count (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix number of entries in the kpu2 cam (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add mbox to read default rule (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: kpu: Input validation check. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: kpu: Fix lodable profile issue (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Convert to C99 flexible array (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Restore stats in defrag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Flow delete and free mbox (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Add traces in NPC mailboxes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix KPU9 state variable for ROCEV2 (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add support for ROCEv2 header parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add more VLAN tag parsing in case of E-tag (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flags for cn20k (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Avoid updating cn10k registers during cn20k reboot (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Do not access match stats for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: Update NPC CSRs (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix out of bound access in entry2counter array (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix initialization of mcam's entry2target_pffunc field (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flag extraction in parse nibble (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix CPT CGX channel mask for cn20k (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flag in KPU profile for CN20K (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: fix mcam hit counter (Satheesh Paul)  [Orabug: 39318904]
- Revert "octeontx2-af: npc: cn20k: Get base steer rule index." (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: fix rule type for LBK VF (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: Fix failed to load custom pfl warning (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: add changes to update CPT pad length offset in KPU (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix search order (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: Use dev_dbg() (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix compilation warnings (Sunil Goutham)  [Orabug: 39318904]
- octeontx2: cn20k: npc: Set action2 for x2 entries. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable action2 programming in npc (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Set default profile DYNAMIC (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix csr register field offset. (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Reject request for x4 entries in x2 profile. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Alloc mcam entry for install flow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Disable fw load faiure warning (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Load custom kpu profile from filesystem. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix install flow priority (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add support for custom mkex profiles (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Get base steer rule index. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Stats support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cn20k: Reject mcam alloc mbox with invalid keytype (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Reserve x4 key mcam entries for ntuple (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Get kex related info from PF. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix parse result nibble mask reading. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Set correct nibble bits for cn20k (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix parse nibble mask (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Avoid accessing cn10k registers (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add new mailboxes for CN20K silicon (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix npc_mcam_get_hit_status mbox for cn10k (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Convert vidx to mcam_idx in mbox handler (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add an mbox interface to defrag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: defragmentation support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Introduce virtual mcam index (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Validate mcam index before enable/disable (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add new mailboxes to get kex config and free counts (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Use common APIs to read/write/copy/enable mcam entry (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Add a new mbox to read/write MCAM hit status (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: debugfs support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Use common APIs to alloc/free/get mcam index. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Allocate default mcam indexes. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Modify alloc entry mailbox (Suman Ghosh)  [Orabug: 39318904]
- ocetontx2-af: npc: cn20k: MKEX profile support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: KPM profile changes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Index management. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: Fix klockwork issues. (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix Support of FDSA tag (George Cherian)  [Orabug: 39318904]
- octeontx2-af: Support for FDSA tag (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Adding changes to parse stacked VLANs (Kiran Kumar K)  [Orabug: 39318904]
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix issue with GRE parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add support to parse more VLAN headers (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix issue with IPV6 GRE and multi VLAN (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add KPU changes to parse fabric path header (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add few missing changes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: allow second pass pkts via default ucast entry (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: suppress kpu profile loading warning (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: use cpt channel mask in flow install path (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: Add NPC support to filter GTP-U and GTP-C packets based on TEID (Suman Ghosh)  [Orabug: 39318904]
- octeontx2: cn20k: Assign unique MCS IDs based on PCI enumeration (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-pf: Choose macsec encryption offload per packet (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: mcs: Use new SCI CAM in hardware (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: mcs: Fix mcs resources free on PF shutdown (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Add devlink parameter to toggle MCS bypass mode (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Display port mapped stats for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add MCS LMAC channel and count configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs set mcs id and silicon check (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix mcs tx_sa_map API (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mcs PN threshold support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: MCS add port configure APIs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: Add MCS parser configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix mcs register offsets (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix unsupported secy stats read (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add MCS support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: mcs: Remove SA stats support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cnf10k-b: mcs: Fix stats reg address (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: rvu: enable mcs fips mailboxes (Ankur Dwivedi)  [Orabug: 39318904]
- octeontx2-af: mcs: add mailboxes for fips (Ankur Dwivedi)  [Orabug: 39318904]
- octeontx2-af: sso: clear all the sets on init (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: tim: add ring priority support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: update TIM interval support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: moderate SSO AF error interrupts (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: lower TIM bucket skip IRQ log level (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: remove GTI clock adjustment (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: update xaq aura offset (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: cleanup SSO EVA on LF reset (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO HW info mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO AGGR config and stats mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO EVA error interrupts (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: update masks for CN20K resources (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: Fixed compilation warnings (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: fix interval flag check (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add TIM hardware info mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add TIM HWWQE mbox support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add mbox to capture counters (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: reveal only TIM params that are available (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: add TIM error af interrupt handlers (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: clear state on TIM ring disable (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: disable preemption when enabling TIM (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: account for cycle wraparound (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: prevent TIM register read reorder (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: fix arguments passed to XAQ aura deinit (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: debugfs: fix undefined SSO register access (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: update TIM adjust GTI errata silicons (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: update TIM adjust GTI errata silicons (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: add TIM adjust GTI errata workaround (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: cn10k: devlink params to configure TIM (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: TIM: Set conditional clock always on (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Apply relevant HW issue workarounds for 96xx B0 silicon (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: Add SSO and TIM units support to the AF driver (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: enable rxc with lookaside cpt lf (Vidya Sagar Velumuri)  [Orabug: 39318904]
- octeontx2-af: fix issue with spitosa table teardown (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: fix cflags include paths (Wladislav Wiebe)  [Orabug: 39318904]
- octeontx2-af: Move out REE mbox messages (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add generic mbox handler for Eblock (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Use AF extension block interface (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add RVU AF extension block interface (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Introducing REE block for 98xx (Smadar Fuks)  [Orabug: 39318904]
- octeontx2-af: fix VF bringup affecting PF promiscous state (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: consider mode when using cpt base channel for bp (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: Update minimum receive frame size (Sathesh Edara)  [Orabug: 39318904]
- octeontx2-af: set default min and max rx len for CPT link (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: add NIX mbox message to get HW info (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: fix inline inbound IPsec configuration (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: support for custom L2 header (Satheesh Paul A)  [Orabug: 39318904]
- octeontx2-af: fix to get different rq mask (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: poll for tx link credits before link mode change (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Handle physical link state change requests (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add mbox to alloc/free BPIDs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Dynamically allocate bpids for CPT and LBK (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support for SPI to SA index translation (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Update HW workarounds for 96xx C0, 98xx and F95xx B0 chips (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add devlink support to configure TL1 RR_PRIO (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: add support for CPT second pass (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: add new mbox to support sync cycle on rx path (Satha Rao)  [Orabug: 39318904]
- octeontx2-af: add support for changing vlan tpid (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-pf: Fix devm_kcalloc() error checking (Dan Carpenter)  [Orabug: 39318904]
- octeontx2-pf: Use new bandwidth profiles in receive queue (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Display new bandwidth profiles too in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Accommodate more bandwidth profiles for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Initialize new NIX SQ context for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Initialize cn20k specific aura and pool contexts (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Skip NDC operations for cn20k (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Extend debugfs support for cn20k NPA (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add cn20k NPA block contexts (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Extend debugfs support for cn20k NIX (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Add cn20k NIX block contexts (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Simplify context writing and reading to hardware (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: convert to ndo_hwtstamp API (Vadim Fedorenko)  [Orabug: 39318904]
- Octeontx2-af: Fix pci_alloc_irq_vectors() return value check (Harshit Mogalapalli)  [Orabug: 39318904]
- Octeontx2-af: Fix missing error code in cgx_probe() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-pf: fix bitmap leak (Bo Sun)  [Orabug: 39318904]
- octeontx2-vf: fix bitmap leak (Bo Sun)  [Orabug: 39318904]
- octeontx2-af: Remove unused declarations (Yue Haibing)  [Orabug: 39318904]
- Octeontx2-af: Fix NIX X2P calibration failures (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-vf: Fix max packet length errors (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Broadcast XON on all channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: use unsigned int as iterator for unsigned values (Simon Horman)  [Orabug: 39318904]
- net: Fix typos (Bjorn Helgaas)  [Orabug: 39318904]
- Octeontx2-af: Debugfs support for firmware data (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: RPM: Update DMA mask (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Disable stale DMAC filters (Subbaraya Sundeep)  [Orabug: 39318904]
- Octeontx2-af: Add programmed macaddr to RVU pfvf (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix error code in rvu_mbox_init() (Dan Carpenter)  [Orabug: 39318904]
- Octeontx2-pf: ethtool: support multi advertise mode (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Introduce mode group index (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx-pf: Update SGMII mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix rvu_mbox_init return path (Subbaraya Sundeep)  [Orabug: 39318904]
- Octeontx2-pf: Fix Backpresure configuration (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: CN20K mbox implementation between PF-VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20K mbox implementation for AF's VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: CN20K mbox REQ/ACK implementation for NIC PF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k mbox to support AF REQ/ACK functionality (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k basic mbox operations and structures (Sai Krishna)  [Orabug: 39318904]
- octeontx2: Set appropriate PF, VF masks and shifts based on silicon (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Avoid typecasts by simplifying otx2_atomic64_add macro (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Annotate mmio regions as __iomem (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: macsec: Get MACSEC capability flag from AF (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Add MACSEC capability flag (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Send Link events one by one (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: NPC: Clear Unicast rule on nixlf detach (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Avoid adding dcbnl_ops for LBK and SDP vf (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Add tracepoint for NIX_PARSE_S (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Add new tracepoint otx2_msg_status (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Add pcifunc also to mailbox tracepoints (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Display names for CPT and UP messages (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: convert dev_dbg to tracepoint in mbox (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Fix ethtool support for SDP representors (Hariprasad Kelam)  [Orabug: 39318904]
- net: octeontx2: Use pure PCI devres API (Philipp Stanner)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP: code clean up (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Remove unused rvu_npc_enable_bcast_entry (Dr. David Alan Gilbert)  [Orabug: 39318904]
- xfrm: Add explicit dev to .xdo_dev_state_{add,delete,free} (Cosmin Ratiu)  [Orabug: 39318904]
- octeontx2-pf: handle otx2_mbox_get_rsp errors (Chenyuan Yang)  [Orabug: 39318904]
- net: octeontx2: Handle XDP_ABORTED and XDP invalid as XDP_DROP (Lorenzo Bianconi)  [Orabug: 39318904]
- octeontx2-af: mcs: Remove redundant 'flush_workqueue()' calls (Chen Ni)  [Orabug: 39318904]
- net: octeontx2: Add metadata support for xdp mode (Lorenzo Bianconi)  [Orabug: 39318904]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 39318904]
- octeontx2: hide unused label (Arnd Bergmann)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP zero copy transmit support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Prepare for AF_XDP (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Reconfigure RSS table after enabling AF_XDP zerocopy on rx queue (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP zero copy receive support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: use xdp_return_frame() to free xdp buffers (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: mcs: Remove dead code and semi-colon from rsrc_name() (Nihar Chaithanya)  [Orabug: 39318904]
- octeontx2-pf: fix error handling of devlink port in rvu_rep_create() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-pf: fix netdev memory leak in rvu_rep_create() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-af: fix build regression without CONFIG_DCB (Arnd Bergmann)  [Orabug: 39318904]
- cn10k-ipsec: Fix compilation error when CONFIG_XFRM_OFFLOAD disabled (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Fix installation of PF multicast rule (Geetha sowjanya)  [Orabug: 39318904]
- cn10k-ipsec: Enable outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Allow ipsec crypto offload for skb with SA (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Process outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Add SA add/del support for outb ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Init hardware for outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Disable backpressure between CPT and NIX (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Move skb fragment map/unmap to common code (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: map skb data as device writeable (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Fix SDP MAC link credits configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Fix spelling mistake "reprentator" -&gt; "representor" (Colin Ian King)  [Orabug: 39318904]
- octeontx2-pf: Adds TC offload support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Implement offload stats ndo for representors (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add devlink port support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add representors for sdp MAC (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Configure VF mtu via representor (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add support to sync link state between representor and VFs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Get VF stats via representor (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add packet path between representor and VF (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add basic net_device_ops (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Create representor netdev (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: RVU representor driver (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Knobs for NPC default rule counters (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Refactor few NPC mcam APIs (Linu Cherian)  [Orabug: 39318904]
- octeontx2-pf: Move shared APIs to header file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Reuse PF max mtu value (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add new APIs for queue memory alloc/free. (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Define common API for HW resources configuration (Geetha sowjanya)  [Orabug: 39318904]
- net: marvell: use ethtool string helpers (Rosen Penev)  [Orabug: 39318904]
- uek: kabi: update kABI files for new symbols (Saeed Mirzamohammadi)  [Orabug: 39268116]
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39167615]  {CVE-2026-31402}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39110670]  {CVE-2026-23278}
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39103229]  {CVE-2026-23270}</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.5.el10uek]" date="1779192000">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39407652]  {CVE-2026-46333}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.6.el10uek]" date="1779796800">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39442660]  {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39442660]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.7.el10uek]" date="1779969600">- tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi)  [Orabug: 39456024]
- tap: free page on error paths in tap_get_user_xdp() (Weiming Shi)  [Orabug: 39456024]
- tun: free page on short-frame rejection in tun_xdp_one() (Weiming Shi)  [Orabug: 39456024]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.7.1.el10uek]" date="1780315200">- smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39474418]</changelog>
</package>
<package pkgid="7c3a28c98e364202a3aa19162e20b64ff531d0f4" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="100.28.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.2.el10uek]" date="1751198400">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
</package>
<package pkgid="b6a19986a560050192d02d6837693f9e5fd7ed47" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="100.28.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.el10uek]" date="1743681600">- block: prevent calls to should_fail_bio() optimized by gcc (Prasad Singamsetty)  [Orabug: 37782458]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)   
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]  
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]  
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
</package>
<package pkgid="df50ec2a8ab4307a49bf3e18b89779093e1e1536" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="101.33.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge) [Orabug: 37976747] {CVE-2025-37903}
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi) [Orabug: 37976752] {CVE-2025-37905}
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [Orabug: 37976858] {CVE-2025-37932}
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski) [Orabug: 37976760] {CVE-2025-37907}
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang) [Orabug: 37976762] {CVE-2025-37908}
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh Edara) [Orabug: 37976864] {CVE-2025-37933}
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan) [Orabug: 37976765] {CVE-2025-37909}
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon) [Orabug: 37976771] {CVE-2025-37910}
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang) [Orabug: 37976728] {CVE-2025-37894}
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein) [Orabug: 37976869] {CVE-2025-37934}
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab) [Orabug: 37976773] {CVE-2025-37911}
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh Ap)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya Kn) [Orabug: 37976731] {CVE-2025-37895}
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe) [Orabug: 37976872] {CVE-2025-37935}
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai) [Orabug: 37970918] {CVE-2025-37891}
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Luoxuanqiang) [Orabug: 37976779] {CVE-2025-37912}
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976783] {CVE-2025-37913}
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976788] {CVE-2025-37914}
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira) [Orabug: 37970915] {CVE-2025-37890}
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976792] {CVE-2025-37915}
- pds_core: remove write-after-free of client_id (Shannon Nelson) [Orabug: 37976797] {CVE-2025-37916}
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud) [Orabug: 37976802] {CVE-2025-37917}
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu) [Orabug: 37976804] {CVE-2025-37918}
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu) [Orabug: 37976806] {CVE-2025-37919}
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (Eryk Kubanski) [Orabug: 37976809] {CVE-2025-37920}
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel) [Orabug: 37976815] {CVE-2025-37921}
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov) [Orabug: 37976734] {CVE-2025-37897}
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom) [Orabug: 37976819] {CVE-2025-37922}
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Sun Peng Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park) [Orabug: 37976821] {CVE-2025-37923}
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan) [Orabug: 37976738] {CVE-2025-37899}
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan) [Orabug: 37976828] {CVE-2025-37924}
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon) [Orabug: 37976832] {CVE-2025-37926}
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen) [Orabug: 37976741] {CVE-2025-37900}
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov) [Orabug: 37976836] {CVE-2025-37927}
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (Longping Wei) [Orabug: 37976844] {CVE-2025-37928}
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Xu Wang) [Orabug: 37977118] {CVE-2025-37990}
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold) [Orabug: 37976744] {CVE-2025-37901}
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson) [Orabug: 37976874] {CVE-2025-37936}
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller) [Orabug: 37977127] {CVE-2025-37991}
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon) [Orabug: 37977182] {CVE-2025-37929}
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner) [Orabug: 37976850] {CVE-2025-37930}
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik) [Orabug: 37976853] {CVE-2025-37931}
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya) [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil) [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert) [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter) [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King) [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche) [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert) [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar) [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang) [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli) [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre) [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta) [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon) [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon) [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth) [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth) [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick) [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli) [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval) [Orabug: 37930100] {CVE-2025-37821}
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang) [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed) [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan) [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.31.1.el10uek]" date="1748952000">- LTS version: v6.12.31 (Jack Vogel)
- drm/gem: Internally test import_attach for imported objects (Thomas Zimmermann)
- x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers (Balbir Singh)
- i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() (Nathan Chancellor)
- pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group() (Dan Carpenter)
- watchdog: aspeed: fix 64-bit division (Arnd Bergmann)
- drm/amdkfd: Correct F8_MODE for gfx950 (Amber Lin)
- serial: sh-sci: Save and restore more registers (Geert Uytterhoeven)
- bpf: abort verification if env-&gt;cur_state-&gt;loop_entry != NULL (Eduard Zingerman)
- drm/amd/display: Exit idle optimizations before accessing PHY (Ovidiu Bunea)
- kbuild: Properly disable -Wunterminated-string-initialization for clang (Nathan Chancellor)
- Fix mis-uses of 'cc-option' for warning disablement (Linus Torvalds)
- gcc-15: disable '-Wunterminated-string-initialization' entirely for now (Linus Torvalds)
- gcc-15: make 'unterminated string initialization' just a warning (Linus Torvalds)
- err.h: move IOMEM_ERR_PTR() to err.h (Raag Jadav)
- spi: spi-fsl-dspi: Reset SR flags before sending a new message (Larisa Grigore)
- spi: spi-fsl-dspi: Halt the module after a new message transfer (Bogdan-Gabriel Roman)
- spi: spi-fsl-dspi: restrict register range for regmap access (Larisa Grigore)
- spi: use container_of_cont() for to_spi_device() (Greg Kroah-Hartman)
- platform/x86: think-lmi: Fix attribute name usage for non-compliant items (Mark Pearson)
- ksmbd: fix stream write failure (Namjae Jeon)
- Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection" (Jernej Skrabec)
- Bluetooth: btmtksdio: Do close if SDIO card removed without close (Chris Lu)
- Bluetooth: btmtksdio: Check function enabled before doing close (Chris Lu)
- nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() (Ryusuke Konishi)
- mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled (Ignacio Moreno Gonzalez)
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Tianyang Zhang)
- memcg: always call cond_resched() after fn() (Breno Leitao)
- highmem: add folio_test_partial_kmap() (Matthew Wilcox)
- Input: xpad - add more controllers (Vicki Pfau)
- Revert "drm/amd: Keep display off while going into S4" (Mario Limonciello)
- smb: client: Reset all search buffer pointers when releasing buffer (Zhaolong Wang)
- arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (Gabor Juhos)
- smb: client: Fix use-after-free in cifs_fill_dirent (Zhaolong Wang) [Orabug: 38094970] {CVE-2025-38051}
- drm/edid: fixed the bug that hdr metadata was not reset (Feijuan Li)
- thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature (Zhang Rui)
- platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin) [Orabug: 38095141] {CVE-2025-38077}
- pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
- pmdomain: renesas: rcar: Remove obsolete nullify checks (Geert Uytterhoeven)
- vmxnet3: update MTU after device quiesce (Ronak Doshi)
- net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
- can: kvaser_pciefd: Fix echo_skb race (Axel Forsman)
- can: kvaser_pciefd: Continue parsing DMA buf after dropped RX (Axel Forsman)
- llc: fix data loss when reading from a socket in llc_ui_recvmsg() (Gavrilov Ilia)
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10 (Ed Burcher)
- ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [Orabug: 38095145] {CVE-2025-38078}
- ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction (Peter Ujfalusi)
- ASoc: SOF: topology: connect DAI to a single DAI link (Kai Vehmanen)
- ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext (Peter Ujfalusi)
- can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp) [Orabug: 38049369] {CVE-2025-38003}
- can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 38049374] {CVE-2025-38004}
- can: slcan: allow reception of short error messages (Carlos Sanchez)
- padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094842] {CVE-2025-38031}
- crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [Orabug: 38095153] {CVE-2025-38079}
- clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe() (André Draszik)
- octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG (Geetha Sowjanya)
- octeontx2-af: Set LMT_ENA bit for APR table entries (Subbaraya Sundeep)
- net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang) [Orabug: 38094978] {CVE-2025-38052}
- octeontx2-pf: Add AF_XDP non-zero copy support (Suman Ghosh)
- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [Orabug: 38049357] {CVE-2025-38000}
- idpf: fix idpf_vport_splitq_napi_poll() (Eric Dumazet)
- io_uring: fix overflow resched cqe reordering (Pavel Begunkov)
- net: lan743x: Restore SGMII CTRL register on resume (Thangaraj Samynathan)
- net: dwmac-sun8i: Use parsed internal PHY address instead of 1 (Paul Kocialkowski)
- pinctrl: qcom: switch to devm_register_sys_off_handler() (Dmitry Baryshkov)
- loop: don't require -&gt;write_iter for writable files in loop_configure (Christoph Hellwig)
- idpf: fix null-ptr-deref in idpf_features_check (Pavan Kumar Linga) [Orabug: 38094982] {CVE-2025-38053}
- ice: Fix LACP bonds without SRIOV environment (Dave Ertman)
- ice: fix vf-&gt;num_mac count with port representors (Jacob Keller)
- bridge: netfilter: Fix forwarding of fragmented packets (Ido Schimmel)
- ptp: ocp: Limit signal/freq counts in summary output functions (Sagi Maimon) [Orabug: 38094984] {CVE-2025-38054}
- Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling (En-Wei Wu)
- Bluetooth: L2CAP: Fix not checking l2cap_chan security level (Luiz Augusto von Dentz)
- perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter) [Orabug: 38094988] {CVE-2025-38055}
- irqchip/riscv-imsic: Start local sync timer on correct CPU (Andrew Bresticker)
- ASoC: SOF: Intel: hda: Fix UAF when reloading module (Tavian Barnes) [Orabug: 38094991] {CVE-2025-38056}
- devres: Introduce devm_kmemdup_array() (Raag Jadav)
- driver core: Split devres APIs to device/devres.h (Andy Shevchenko)
- dmaengine: fsl-edma: Fix return code for unhandled interrupts (Stefan Wahren)
- dmaengine: idxd: Fix -&gt;poll() return value (Dave Jiang)
- xfrm: Sanitize marks before insert (Paul Chaignon)
- clk: sunxi-ng: d1: Add missing divider for MMC mod clocks (Andre Przywara)
- remoteproc: qcom_wcnss: Fix on platforms without fallback regulators (Matti Lehtimäki)
- kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() (David Hildenbrand)
- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (Seongman Lee)
- dmaengine: idxd: Fix allowing write() from different address spaces (Vinicius Costa Gomes)
- xfrm: Fix UDP GRO handling for some corner cases (Tobias Brunner)
- espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca)
- espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094993] {CVE-2025-38057}
- soundwire: bus: Fix race on the creation of the IRQ domain (Charles Keepax)
- __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [Orabug: 38095000] {CVE-2025-38058}
- drm/amd/display: Call FP Protect Before Mode Programming/Mode Support (Austin Zheng)
- xenbus: Allow PVH dom0 a non-local xenstore (Jason Andryuk)
- x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust &gt;= 1.88 (Paweł Anikiel) [Orabug: 38094847] {CVE-2025-38033}
- wifi: iwlwifi: add support for Killer on MTL (Johannes Berg)
- block: only update request sector if needed (Johannes Thumshirn)
- tools: ynl-gen: validate 0 len strings from kernel (David Wei)
- btrfs: avoid NULL pointer dereference if no valid csum tree (Qu Wenruo) [Orabug: 38095010] {CVE-2025-38059}
- btrfs: handle empty eb-&gt;folios in num_extent_folios() (Boris Burkov)
- btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [Orabug: 38094856] {CVE-2025-38034}
- btrfs: compression: adjust cb-&gt;compressed_folios allocation type (Kees Cook)
- ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers (Stefan Binding)
- cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function (Pali Rohár)
- cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info() (Pali Rohár)
- io_uring/fdinfo: annotate racy sq/cq head/tail reads (Jens Axboe)
- nvmet-tcp: don't restore null sk_state_change (Alistair Francis) [Orabug: 38094863] {CVE-2025-38035}
- ALSA: usb-audio: Fix duplicated name in MIDI substream names (Takashi Iwai)
- nvme-pci: add quirks for WDC Blue SN550 15b7:5009 (Guan Wentao)
- nvme-pci: add quirks for device 126f:1001 (Guan Wentao)
- ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 (Takashi Iwai)
- ASoC: cs42l43: Disable headphone clamps during type detection (Charles Keepax)
- platform/x86: ideapad-laptop: add support for some new buttons (Gašper Nemgar)
- platform/x86: asus-wmi: Disable OOBE state after resume from hibernation (Pavel Nikulin)
- platform/x86/intel: hid: Add Pantherlake support (Saranya Gopal)
- smb: server: smb2pdu: check return value of xa_store() (Salah Triki)
- pinctrl: meson: define the pull up/down resistor value as 60 kOhm (Martin Blumenstingl)
- book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n (Ritesh Harjani)
- ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of() (Chenyuan Yang)
- drm: Add valid clones check (Jessica Zhang)
- drm/panel-edp: Add Starry 116KHD024006 (Douglas Anderson)
- drm/buddy: fix issue that force_merge cannot free all roots (Lin Cao)
- drm/atomic: clarify the rules around drm_atomic_state-&gt;allow_modeset (Simona Vetter)
- drm/xe: Reject BO eviction if BO is bound to current VM (Oak Zeng)
- drm/xe/sa: Always call drm_suballoc_manager_fini() (Michal Wajdeczko)
- wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event (Ching-Te Ku)
- drm/xe: Do not attempt to bootstrap VF in execlists mode (Maarten Lankhorst)
- drm/xe: Move suballocator init to after display init (Maarten Lankhorst)
- wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (P Praneesh)
- drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE (Zhi Wang)
- drm: bridge: adv7511: fill stream capabilities (Olivier Moysan)
- wifi: ath12k: Fix end offset bit definition in monitor ring descriptor (P Praneesh)
- wifi: ath12k: Fetch regdb.bin file from board-2.bin (Aaradhana Sahu)
- wifi: ath9k: return by of_get_mac_address (Rosen Penev)
- drm/xe/pf: Reset GuC VF config when unprovisioning critical resource (Michal Wajdeczko)
- accel/qaic: Mask out SR-IOV PCI resources (Youssef Samir)
- wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override (Nicolas Escande)
- regulator: ad5398: Add device tree support (Isaac Scott)
- spi: zynqmp-gqspi: Always acknowledge interrupts (Sean Anderson)
- wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet (Ping-Ke Shih)
- wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate (Bitterblue Smith)
- wifi: rtl8xxxu: retry firmware download on error (Soeren Moch)
- clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation (Lad Prabhakar)
- perf/amd/ibs: Fix -&gt;config to sample period calculation for OP PMU (Ravi Bangoria)
- perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (Ravi Bangoria)
- firmware: arm_scmi: Relax duplicate name constraint across protocol ids (Sudeep Holla)
- bpftool: Fix readlink usage in get_fd_type (Viktor Malik)
- bpf: Use kallsyms to find the function name of a struct_ops's stub function (Martin Kafai Lau)
- drm/ast: Find VBIOS mode from regular display size (Thomas Zimmermann)
- dm vdo: use a short static string for thread name prefix (Matthew Sakai)
- dm vdo indexer: prevent unterminated string warning (Chung Chung)
- irqchip/riscv-aplic: Add support for hart indexes (Vladimir Kondratiev)
- ASoC: rt722-sdca: Add some missing readable registers (Charles Keepax)
- ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode (Cezary Rojewski)
- arm64: zynqmp: add clock-output-names property in clock nodes (Naman Trivedi Manojbhai)
- HID: usbkbd: Fix the bit shift number for LED_KANA (Junan)
- wifi: ath12k: Avoid napi_sync() before napi_enable() (Avula Sri Charan)
- scsi: st: Restore some drive settings after reset (Kai Mäkisara)
- net/mana: fix warning in the writer of client oob (Konstantin Taranov)
- drm/xe/relay: Don't use GFP_KERNEL for new transactions (Michal Wajdeczko)
- ice: count combined queues using Rx/Tx count (Michal Swiatkowski)
- perf: Avoid the read if the count is already updated (Peter Zijlstra)
- rcu: fix header guard for rcu_all_qs() (Ankur Arora)
- rcu: handle unstable rdp in rcu_read_unlock_strict() (Ankur Arora)
- rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y (Ankur Arora)
- ice: treat dyn_allowed only as suggestion (Michal Swiatkowski)
- ice: init flow director before RDMA (Michal Swiatkowski)
- bridge: mdb: Allow replace of a host-joined group (Petr Machata)
- net: flush_backlog() small changes (Eric Dumazet)
- r8169: don't scan PHY addresses &gt; 0 (Heiner Kallweit)
- ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only (Geert Uytterhoeven)
- vxlan: Annotate FDB data races (Ido Schimmel) [Orabug: 38094879] {CVE-2025-38037}
- cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (Dhananjay Ugwekar) [Orabug: 38094888] {CVE-2025-38038}
- tools: ynl-gen: don't output external constants (Jakub Kicinski)
- eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs (Alexander Duyck)
- drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0 (Cristian Ciocaltea)
- media: qcom: camss: Add default case in vfe_src_pad_code (Depeng Shao)
- media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available (Depeng Shao)
- f2fs: introduce f2fs_base_attr for global sysfs entries (Jaegeuk Kim)
- hwmon: (xgene-hwmon) use appropriate type for the latency value (Andrey Vatoropin)
- tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options (Len Brown)
- net: page_pool: avoid false positive warning if NAPI was never added (Jakub Kicinski)
- clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs (Jordan Crouse)
- wifi: rtw89: call power_on ahead before selecting firmware (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before accessing (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before getting its size (Ping-Ke Shih)
- wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang (Ching-Te Ku)
- wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix download_firmware_validate() for RTL8814AU (Bitterblue Smith)
- ext4: remove writable userspace mappings before truncating page cache (Zhang Yi)
- ext4: don't write back data before punch hole in nojournal mode (Zhang Yi)
- leds: trigger: netdev: Configure LED blink interval for HW offload (Marek Vasut)
- pstore: Change kmsg_bytes storage size to u32 (Kees Cook)
- iio: adc: ad7944: don't use storagebits for sizing (David Lechner)
- r8152: add vendor/device ID pair for Dell Alienware AW1022z (Aleksander Jan Bajkowski)
- ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). (Kuniyuki Iwashima)
- arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src (Athira Rajeev)
- powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (Gaurav Batra)
- powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Gaurav Batra)
- net: fec: Refactor MAC reset to function (Csókás Bence)
- wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx (Emmanuel Grumbach)
- wifi: mac80211: remove misplaced drv_mgd_complete_tx() call (Johannes Berg)
- wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() (Johannes Berg)
- wifi: iwlwifi: don't warn during reprobe (Miri Korenblit)
- wifi: iwlwifi: use correct IMR dump variable (Johannes Berg)
- mptcp: pm: userspace: flags: clearer msg if no remote addr (Matthieu Baerts)
- wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV (P Praneesh)
- xfrm: prevent high SEQ input in non-ESN mode (Leon Romanovsky)
- drm/v3d: Add clock handling (Stefan Wahren)
- net/mlx5e: reduce the max log mpwrq sz for ECPF and reps (William Tu)
- net/mlx5e: reduce rep rxq depth to 256 for ECPF (William Tu)
- net/mlx5e: set the tx_queue_len for pfifo_fast (William Tu)
- net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB (Alexei Lazar)
- net/mlx5: XDP, Enable TX side XDP multi-buffer support (Alexei Lazar)
- scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr() (Chaohai Chen)
- drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer() (Alex Deucher)
- drm/amdgpu: enlarge the VBIOS binary size limit (Morris Zhang)
- drm/amdgpu: Use active umc info from discovery (Lijo Lazar)
- drm/amd/display: Populate register address for dentist for dcn401 (Dillon Varone)
- drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It (Austin Zheng)
- drm/amd/display: Increase block_sequence array size (Joshua Aberback) [Orabug: 38095164] {CVE-2025-38080}
- drm/amd/display: Initial psr_version with correct setting (Tom Chung)
- drm/amd/display: Update CR AUX RD interval interpretation (George Shen)
- Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY" (Brandon Syu)
- drm/amd/display: Support multiple options during psr entry. (Martin Tsai)
- drm/amd/pm: Skip P2S load for SMU v13.0.12 (Asad Kamal)
- drm/amdgpu: reset psp-&gt;cmd to NULL after releasing the buffer (Jiang Liu)
- drm/amd/display: Don't try AUX transactions on disconnected link (Ilya Bakoulin)
- drm/amd/display: pass calculated dram_speed_mts to dml2 (Charlene Liu)
- drm/amdgpu: Set snoop bit for SDMA for MI series (Harish Kasiviswanathan)
- drm/amdkfd: fix missing L2 cache info in topology (Eric Huang)
- drm/amdgpu/mes11: fix set_hw_resources_1 calculation (Alex Deucher)
- net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size (Huacai Chen)
- soundwire: cadence_master: set frame shape and divider based on actual clk freq (Bard Liao)
- soundwire: amd: change the soundwire wake enable/disable sequence (Vijendar Mukunda)
- phy: exynos5-usbdrd: fix EDS distribution tuning (gs101) (André Draszik)
- phy: core: don't require set_mode() callback for phy_get_mode() to work (Dmitry Baryshkov)
- phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF (Damon Ding)
- pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down (Claudiu Beznea)
- serial: sh-sci: Update the suspend/resume support (Claudiu Beznea)
- sched: Reduce the default slice to avoid tasks getting an extra tick (Zihan Zhou)
- x86/traps: Cleanup and robustify decode_bug() (Peter Zijlstra)
- x86/ibt: Handle FineIBT in handle_cfi_failure() (Peter Zijlstra)
- drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set (Shuicheng Lin)
- drm/xe/debugfs: fixed the return value of wedged_mode_set (Xin Wang)
- clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate (Krzysztof Kozlowski)
- clk: qcom: ipq5018: allow it to be bulid on arm32 (Karl Chan)
- drm/xe: Fix xe_tile_init_noalloc() error propagation (Lucas De Marchi)
- drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init() (Lucas De Marchi)
- net/mlx4_core: Avoid impossible mlx4_db_alloc() order value (Kees Cook)
- media: v4l: Memset argument to 0 before calling get_mbus_config pad op (Sakari Ailus)
- media: i2c: imx219: Correct the minimum vblanking value (David Plowman)
- kunit: tool: Use qboot on QEMU x86_64 (Brendan Jackman)
- smack: Revert "smackfs: Added check catlen" (Konstantin Andreev)
- smack: recognize ipv4 CIPSO w/o categories (Konstantin Andreev)
- pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map (Valentin Caron)
- ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() (Kuninori Morimoto)
- ASoC: tas2764: Power up/down amp on mute ops (Hector Martin)
- ASoC: tas2764: Mark SW_RESET as volatile (Hector Martin)
- ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG (Hector Martin)
- ASoC: ops: Enforce platform maximum on initial value (Martin Povišer)
- firmware: xilinx: Dont send linux address to get fpga config get status (Siva Durga Prasad Paladugu)
- firmware: arm_ffa: Handle the presence of host partition in the partition info (Sudeep Holla)
- firmware: arm_ffa: Reject higher major version as incompatible (Sudeep Holla)
- net/mlx5: Apply rate-limiting to high temperature warning (Shahar Shitrit)
- net/mlx5: Modify LSB bitmask in temperature event to include only the first bit (Shahar Shitrit)
- media: test-drivers: vivid: don't call schedule in loop (Hans Verkuil)
- irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base (Andrew Jones)
- hrtimers: Replace hrtimer_clock_to_base_table with switch-case (Andy Shevchenko)
- vxlan: Join / leave MC group after remote changes (Petr Machata)
- ACPI: HED: Always initialize before evged (Xiaofei Tan)
- PCI: Fix old_size lower bound in calculate_iosize() too (Ilpo Järvinen)
- eth: mlx4: don't try to complete XDP frames in netpoll (Jakub Kicinski)
- bpf: copy_verifier_state() should copy 'loop_entry' field (Eduard Zingerman) [Orabug: 38095018] {CVE-2025-38060}
- bpf: don't do clean_live_states when state-&gt;loop_entry-&gt;branches &gt; 0 (Eduard Zingerman)
- can: c_can: Use of_property_present() to test existence of DT property (Krzysztof Kozlowski)
- pmdomain: imx: gpcv2: use proper helper for property detection (Ahmad Fatoum)
- RDMA/core: Fix best page size finding when it can cross SG entries (Michael Margolin)
- serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (Alexis Lothoré) [Orabug: 38094901] {CVE-2025-38040}
- drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink (Harry Wentland)
- Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP" (Leo Zeng)
- drm/amd/display: Read LTTPR ALPM caps during link cap retrieval (George Shen)
- drm/amd/display: Fix BT2020 YCbCr limited/full range input (Ilya Bakoulin)
- drm/amd/display: Guard against setting dispclk low when active (Nicholas Kazlauskas)
- drm/amd/display: Add support for disconnected eDP streams (Harry Vanzylldejong)
- drm/amd/pm: Fetch current power limit from PMFW (Lijo Lazar)
- irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector (Anup Patel)
- eeprom: ee1004: Check chip before probing (Eddie James)
- mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs (Chris Morgan)
- i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA) (Frank Li)
- EDAC/ie31200: work around false positive build warning (Arnd Bergmann)
- power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree (Chris Morgan)
- net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [Orabug: 38095024] {CVE-2025-38061}
- wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU (Kuan-Chung Chen)
- wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware (Ping-Ke Shih)
- wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32() (Ping-Ke Shih)
- wifi: rtw89: fw: propagate error code from rtw89_h2c_tx() (Ping-Ke Shih)
- wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU (Bitterblue Smith)
- PCI: epf-mhi: Update device ID for SA8775P (Mrinmay Sarkar)
- clocksource: mips-gic-timer: Enable counter when CPUs start (Paul Burton)
- MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core (Paul Burton)
- genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (Jason Gunthorpe) [Orabug: 38095031] {CVE-2025-38062}
- x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op() (Uros Bizjak)
- drm/amdgpu: remove all KFD fences from the BO on release (Christian König)
- MIPS: Use arch specific syscall name match function (Bibo Mao)
- drm/xe/oa: Ensure that polled read returns latest data (Umesh Nerlige Ramappa)
- net: ipv6: Init tunnel link-netns before registering dev (Xiao Liang)
- crypto: skcipher - Zap type in crypto_alloc_sync_skcipher (Herbert Xu)
- crypto: ahash - Set default reqsize from ahash_alg (Herbert Xu)
- x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh)
- net/mlx5: Change POOL_NEXT_SIZE define value and make it global (Patrisious Haddad)
- scsi: scsi_debug: First fixes for tapes (Kai Mäkisara)
- dm: fix unconditional IO throttle caused by REQ_PREFLUSH (Jinliang Zheng) [Orabug: 38095038] {CVE-2025-38063}
- libbpf: Fix out-of-bound read (Nandakumar Edamana)
- loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize (Christoph Hellwig)
- net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode (Jianbo Liu)
- media: tc358746: improve calculation of the D-PHY timing registers (Matthias Fend)
- media: adv7180: Disable test-pattern control on adv7180 (Niklas Söderlund)
- cpuidle: menu: Avoid discarding useful information (Rafael J. Wysocki)
- vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines (Konstantin Shkolnyy)
- x86/nmi: Add an emergency handler in nmi_desc &amp; use it in nmi_shootdown_cpus() (Waiman Long)
- ASoC: mediatek: mt8188: Add reference for dmic clocks (Nícolas F R A Prado)
- ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile (Nícolas F R A Prado)
- drm/amd/display: Fix mismatch type comparison (Navid Assadian)
- drm/amd/display: fix dcn4x init failed (Charlene Liu)
- drm/amd/display: handle max_downscale_src_width fail check (Yihan Zhu)
- x86/build: Fix broken copy command in genimage.sh when making isoimage (Nir Lichtman)
- Octeontx2-af: RPM: Register driver with PCI subsys IDs (Hariprasad Kelam)
- bpf: Search and add kfuncs in struct_ops prologue and epilogue (Amery Hung)
- soc: ti: k3-socinfo: Do not use syscon helper to build regmap (Andrew Davis)
- wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band (Ramasamy Kaliappan)
- bonding: report duplicate MAC address in all situations (Hangbin Liu)
- net: xgene-v2: remove incorrect ACPI_PTR annotation (Arnd Bergmann)
- net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only (Eric Woudstra)
- leds: pwm-multicolor: Add check for fwnode_property_read_u32 (Yuanjun Gong)
- drm/xe: xe_gen_wa_oob: replace program_invocation_short_name (Daniel Gomez)
- drm/amdkfd: KFD release_work possible circular locking (Philip Yang)
- pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf (Inochi Amaoto)
- selftests/net: have `gro.sh -t` return a correct exit code (Kevin Krakauer)
- net/mlx5: Avoid report two health errors on same syndrome (Moshe Shemesh)
- drm/xe/pf: Create a link between PF and VF devices (K V P Satyanarayana)
- drm/xe/vf: Retry sending MMIO request to GUC on timeout error (K V P Satyanarayana)
- firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar) [Orabug: 38094925] {CVE-2025-38043}
- PCI: brcmstb: Add a softdep to MIP MSI-X driver (Stanimir Varbanov)
- PCI: brcmstb: Expand inbound window size up to 64GB (Stanimir Varbanov)
- wifi: ath12k: Report proper tx completion status to mac80211 (Vinith Kumar R)
- soc: apple: rtkit: Implement OSLog buffers properly (Hector Martin)
- soc: apple: rtkit: Use high prio work queue (Janne Grunau)
- perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters (Rob Herring)
- fpga: altera-cvp: Increase credit timeout (Kuhanh Murugasen Krishnan)
- drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence (AngeloGioacchino Del Regno)
- ARM: at91: pm: fix at91_suspend_finish for ZQ calibration (Li Bin)
- hwmon: (gpio-fan) Add missing mutex locks (Alexander Stein)
- x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Breno Leitao)
- clk: imx8mp: inform CCF of maximum frequency of clocks (Ahmad Fatoum)
- media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value (Ricardo Ribalda)
- media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map (Ricardo Ribalda)
- ublk: complete command synchronously on error (Caleb Sander)
- block: mark bounce buffering as incompatible with integrity (Christoph Hellwig)
- drm/rockchip: vop2: Add uv swap for cluster window (Andy Yan)
- ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). (Kuniyuki Iwashima)
- scsi: logging: Fix scsi_logging_level bounds (Nicolas Bouchinet)
- ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7 (Maciej S. Szmigiero)
- perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (Saket Kumar Bhaskar)
- net: pktgen: fix mpls maximum labels list parsing (Peter Seiderer)
- media: imx335: Set vblank immediately (Paul Elder)
- iommufd: Disallow allocating nested parent domain with fault ID (Yi Liu)
- ublk: enforce ublks_max only for unprivileged devices (Uday Shankar)
- dpll: Add an assertion to check freq_supported_num (Jiasheng Jiang)
- net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104 (Andrei Botila)
- net: ethernet: ti: cpsw_new: populate netdev of_node (Alexander Sverdlin)
- rcu: Fix get_state_synchronize_rcu_full() GP-start detection (Paul E. McKenney)
- pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" (Artur Weber)
- media: cx231xx: set device_caps for 417 (Hans Verkuil) [Orabug: 38094934] {CVE-2025-38044}
- perf/core: Clean up perf_try_init_event() (Peter Zijlstra)
- drm/amd/display: Request HW cursor on DCN3.2 with SubVP (Aric Cyr)
- drm/amd/display: Fix p-state type when p-state is unsupported (Dillon Varone)
- drm/amd/display: Fix DMUB reset sequence for DCN401 (Dillon Varone)
- drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination (George Shen)
- drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35 (Nicholas Kazlauskas)
- drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c (Victor Lu)
- remoteproc: qcom_wcnss: Handle platforms with only single power domain (Matti Lehtimäki)
- blk-throttle: don't take carryover for prioritized processing of metadata (Ming Lei)
- net: phylink: use pl-&gt;link_interface in phylink_expects_phy() (Choong Yong Liang)
- drm/gem: Test for imported GEM buffers with helper (Thomas Zimmermann)
- orangefs: Do not truncate file size (Matthew Wilcox) [Orabug: 38095056] {CVE-2025-38065}
- soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables (AngeloGioacchino Del Regno)
- dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [Orabug: 38095063] {CVE-2025-38066}
- usb: xhci: set page size to the xHCI-supported size (Niklas Neronin)
- media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() (Markus Elfring)
- ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 (Svyatoslav Ryhel)
- soc: samsung: include linux/array_size.h where needed (Arnd Bergmann)
- drm/xe: Retry BO allocation (Matthew Brost)
- drm/xe: Nuke VM's mapping upon close (Matthew Brost)
- ieee802154: ca8210: Use proper setters and getters for bitwise types (Andy Shevchenko)
- rtc: ds1307: stop disabling alarms on probe (Alexandre Belloni)
- tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() (Eric Dumazet)
- ALSA: seq: Improve data consistency at polling (Takashi Iwai)
- powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 (Andreas Schwab)
- arm64: tegra: Resize aperture for the IGX PCIe C5 slot (Jonathan Hunter)
- arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator (Diogo Ivo)
- drm/amdgpu: Fix missing drain retry fault the last entry (Emily Deng)
- drm/amdkfd: Set per-process flags only once cik/vi (Harish Kasiviswanathan)
- drm/amdkfd: Set per-process flags only once for gfx9/10/11/12 (Harish Kasiviswanathan)
- crypto: mxs-dcp - Only set OTP_KEY bit for OTP key (Sven Schwermer)
- crypto: lzo - Fix compression buffer overrun (Herbert Xu) [Orabug: 38095079] {CVE-2025-38068}
- misc: pci_endpoint_test: Give disabled BARs a distinct error code (Niklas Cassel)
- PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops (Christian Bruel) [Orabug: 38095087] {CVE-2025-38069}
- watchdog: aspeed: Update bootstatus handling (Chin-Ting Kuo)
- cpufreq: tegra186: Share policy per cluster (Aaron Kling)
- iommu/amd/pgtbl_v2: Improve error handling (Vasant Hegde)
- coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t (Levi Yun)
- badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable &lt; 0 (Coly Li)
- ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup() (Alexey Klimov)
- auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" (Andy Shevchenko)
- gfs2: Check for empty queue in run_queue (Andreas Gruenbacher)
- drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch (Leon Huang)
- drm/amd/display: not abort link train when bw is low (Peichen Huang)
- drm/amd/display: calculate the remain segments for all pipes (Zhikai Zhai)
- drm/amd/display: remove minimum Dispclk and apply oem panel timing. (Charlene Liu)
- ipv6: save dontfrag in cork (Willem de Bruijn)
- wifi: cfg80211: allow IR in 20 MHz configurations (Anjaneyulu)
- wifi: mac80211_hwsim: Fix MLD address translation (Ilan Peer)
- wifi: mac80211: fix warning on disconnect during failed ML reconf (Johannes Berg)
- wifi: iwlwifi: fix the ECKV UEFI variable name (Emmanuel Grumbach)
- wifi: iwlwifi: mark Br device not integrated (Johannes Berg)
- wifi: iwlwifi: fix debug actions order (Johannes Berg) [Orabug: 38094942] {CVE-2025-38045}
- wifi: iwlwifi: w/a FW SMPS mode selection (Daniel Gabay)
- wifi: iwlwifi: don't warn when if there is a FW error (Miri Korenblit)
- printk: Check CON_SUSPEND when unblanking a console (Marcos Paulo de Souza)
- iommu: Keep dev-&gt;iommu state consistent (Robin Murphy)
- hwmon: (dell-smm) Increment the number of fans (Kurt Borja)
- wifi: iwlwifi: mvm: fix setting the TK when associated (Avraham Stern)
- usb: xhci: Don't change the status of stalled TDs on failed Stop EP (Michał Pecio)
- mmc: sdhci: Disable SD card clock before changing parameters (Erick Shepherd)
- mmc: dw_mmc: add exynos7870 DW MMC support (Kaustabh Chakraborty)
- arm64/mm: Check PUD_TYPE_TABLE in pud_bad() (Ryan Roberts)
- arm64/mm: Check pmd_table() in pmd_trans_huge() (Ryan Roberts)
- phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set (Andy Yan)
- PNP: Expand length of fixup id string (Kees Cook)
- netfilter: conntrack: Bound nf_conntrack sysctl writes (Nicolas Bouchinet)
- wifi: rtw89: set force HE TB mode when connecting to 11ax AP (Dian-Syuan Yang)
- timer_list: Don't use %pK through printk() (Thomas Weißschuh)
- net: hsr: Fix PRP duplicate detection (Jaakko Karrenpalo)
- net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe (Jonas Karlman)
- posix-timers: Ensure that timer initialization is fully visible (Thomas Gleixner)
- posix-timers: Add cond_resched() to posix_timer_add() search loop (Eric Dumazet)
- RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() (Maher Sanalla)
- ext4: do not convert the unwritten extents if data writeback fails (Baokun Li)
- ext4: reject the 'data_err=abort' option in nojournal mode (Baokun Li)
- clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490 (Taniya Das)
- ASoC: sun4i-codec: support hp-det-gpios property (Ryan Walklin)
- drm/amdgpu: Update SRIOV video codec caps (David Rosca)
- drm/amdgpu/gfx11: don't read registers in mqd init (Alex Deucher)
- drm/amdgpu/gfx12: don't read registers in mqd init (Alex Deucher)
- mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check (Shree Ramamoorthy)
- pinctrl-tegra: Restore SFSEL bit when freeing pins (Prathamesh Shete)
- xen: Add support for XenServer 6.1 platform device (Frediano Ziglio)
- net/smc: use the correct ndev to find pnetid by pnetid table (Guangguan Wang)
- dm: restrict dm device size to 2^63-512 bytes (Mikulas Patocka)
- crypto: octeontx2 - suppress auth failure screaming due to negative tests (Shashank Gupta)
- kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf (Masahiro Yamada)
- kbuild: fix argument parsing in scripts/config (Seyediman Seyedarab)
- bpf: Allow pre-ordering for bpf cgroup progs (Yonghong Song)
- ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect (Nícolas F R A Prado)
- ASoC: pcm6240: Drop bogus code handling IRQ as GPIO (Linus Walleij)
- spi: spi-mux: Fix coverity issue, unchecked return value (Sergio Perez Gonzalez)
- erofs: initialize decompression early (Gao Xiang)
- thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer (Mika Westerberg)
- objtool: Fix error handling inconsistencies in check() (Josh Poimboeuf)
- rtc: rv3032: fix EERD location (Alexandre Belloni)
- tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() (Ilpo Järvinen)
- jbd2: do not try to recover wiped journal (Jan Kara)
- PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off() (Frank Li)
- bpf: Return prog btf_id without capable check (Mykyta Yatsenko)
- vfio/pci: Handle INTx IRQ_NOTCONNECTED (Alex Williamson)
- scsi: st: ERASE does not change tape location (Kai Mäkisara)
- scsi: st: Tighten the page format heuristics with MODE SELECT (Kai Mäkisara)
- hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure (Al Viro)
- ext4: reorder capability check last (Christian Göttsche)
- riscv: Call secondary mmu notifier when flushing the tlb (Alexandre Ghiti)
- bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set (Shantiprasad Shettar)
- wifi: mwifiex: Fix HT40 bandwidth issue. (Jeff Chen)
- um: Update min_low_pfn to match changes in uml_reserved (Tiwei Bie)
- um: Store full CSGSFS and SS register from mcontext (Benjamin Berg)
- clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug (Nick Hu)
- dlm: make tcp still work in multi-link env (Heming Zhao)
- s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste() (Heiko Carstens)
- i3c: master: svc: Fix missing STOP for master request (Stanley Chu)
- drm/amdgpu: adjust drm_firmware_drivers_only() handling (Alex Deucher)
- drm/amd/display: Guard against setting dispclk low for dcn31x (Jing Zhou)
- drm/amdgpu: release xcp_mgr on exit (Flora Cui)
- blk-cgroup: improve policy registration error handling (Chen Linxuan)
- btrfs: send: return -ENAMETOOLONG when attempting a path that is too long (Filipe Manana)
- btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work() (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to async workers (Filipe Manana)
- btrfs: run btrfs_error_commit_super() early (Qu Wenruo)
- btrfs: avoid linker error in btrfs_find_create_tree_block() (Mark Harmstone)
- btrfs: make btrfs_discard_workfn() block_group ref explicit (Boris Burkov)
- i2c: pxa: fix call balance of i2c-&gt;clk handling routines (Vitalii Mordan)
- i2c: qup: Vote for interconnect bandwidth to DRAM (Stephan Gerhold)
- x86/mm: Check return value from memblock_phys_alloc_range() (Philip Redkin) [Orabug: 38095101] {CVE-2025-38071}
- x86/microcode: Update the Intel processor flag scan check (Sohil Mehta)
- x86/smpboot: Fix INIT delay assignment for extended Intel Families (Sohil Mehta)
- x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP (Ingo Molnar)
- x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers (Thomas Huth)
- wifi: mt76: mt7925: fix fails to enter low power mode in suspend state (Quan Zhou)
- wifi: mt76: mt7925: load the appropriate CLC data based on hardware type (Ming Yen Hsieh)
- wifi: mt76: mt7996: revise TXS size (Benjamin Lin)
- wifi: mt76: mt7996: fix SER reset trigger on WED reset (Rex Lu)
- wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 (Felix Fietkau)
- cgroup/rstat: avoid disabling irqs for O(num_cpu) (Eric Dumazet)
- drm/amdgpu: Skip pcie_replay_count sysfs creation for VF (Victor Skvortsov)
- mmc: host: Wait for Vdd to settle on card power off (Erick Shepherd)
- staging: vchiq_arm: Create keep-alive thread during probe (Stefan Wahren)
- pidfs: improve multi-threaded exec and premature thread-group leader exit polling (Christian Brauner)
- libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [Orabug: 38095109] {CVE-2025-38072}
- ext4: on a remount, only log the ro or r/w state when it has changed (Nicolas Bretz)
- xen/pci: Do not register devices with segments &gt;= 0x10000 (Roger Pau Monné)
- PCI: vmd: Disable MSI remapping bypass under Xen (Roger Pau Monné)
- drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12 (Jonathan Kim)
- drm/amdgpu/discovery: check ip_discovery fw file available (Flora Cui)
- pNFS/flexfiles: Report ENETDOWN as a connection error (Trond Myklebust)
- tools/build: Don't pass test log files to linker (Ian Rogers)
- r8169: disable RTL8126 ZRX-DC timeout (Chunhao Lin)
- PCI: dwc: ep: Ensure proper iteration over outbound map windows (Frank Li)
- objtool: Properly disable uaccess validation (Josh Poimboeuf)
- lockdep: Fix wait context check on softirq for PREEMPT_RT (Ryo Takakura)
- dql: Fix dql-&gt;limit value when reset. (Jing Su)
- Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken (Pedro Nishiyama)
- Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal (Sean Wang)
- thermal/drivers/qoriq: Power down TMU on system suspend (Alice Guo)
- thermal/drivers/mediatek/lvts: Start sensor interrupts disabled (Nícolas F R A Prado)
- net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus (Hans-Frieder Vogt)
- net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards (Hans-Frieder Vogt)
- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (Daniel Hsu)
- ASoC: codecs: wsa883x: Correct VI sense channel mask (Krzysztof Kozlowski)
- ASoC: codecs: wsa884x: Correct VI sense channel mask (Krzysztof Kozlowski)
- spi-rockchip: Fix register out of bounds access (Luis de Arquer) [Orabug: 38095173] {CVE-2025-38081}
- SUNRPC: rpcbind should never reset the port to the value '0' (Trond Myklebust)
- SUNRPC: rpc_clnt_set_transport() must not change the autobind setting (Trond Myklebust)
- NFSv4: Treat ENETUNREACH errors as fatal for state recovery (Trond Myklebust)
- cifs: Fix establishing NetBIOS session for SMB2+ connection (Pali Rohár)
- cifs: add validation check for the fields in smb_aces (Namjae Jeon)
- cifs: Set default Netbios RFC1001 server name to hostname in UNC (Pali Rohár)
- fbdev: core: tileblit: Implement missing margin clearing for tileblit (Zsolt Kajtar)
- fbcon: Use correct erase colour for clearing in fbcon (Zsolt Kajtar)
- fbdev: fsl-diu-fb: add missing device_remove_file() (Shixiong Ou)
- riscv: Allow NOMMU kernels to access all of RAM (Samuel Holland)
- mailbox: use error ret code of of_parse_phandle_with_args() (Tudor Ambarus)
- mailbox: pcc: Use acpi_os_ioremap() instead of ioremap() (Sudeep Holla)
- tpm: Convert warn to dbg in tpm2_start_auth_session() (Jonathan Mcdowell)
- ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list (Diogo Ivo)
- tracing: Mark binary printing functions with __printf() attribute (Andy Shevchenko)
- iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability (Yi Liu)
- arm64: Add support for HIP09 Spectre-BHB mitigation (Jinqian Yang)
- SUNRPC: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFS: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Trond Myklebust)
- io_uring/msg: initialise msg request opcode (Pavel Begunkov)
- exfat: call bh_read in get_block only when necessary (Sungjong Seo)
- fuse: Return EPERM rather than ENOSYS from link() (Matt Johnston)
- smb: client: Store original IO parameters and prevent zero IO sizes (Zhaolong Wang)
- cifs: Fix negotiate retry functionality (Pali Rohár)
- cifs: Fix querying and creating MF symlinks over SMB1 (Pali Rohár)
- cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES (Pali Rohár)
- s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log (Tony Krowiak)
- x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li) [Orabug: 38094951] {CVE-2025-38047}
- kconfig: merge_config: use an empty file as initfile (Daniel Gomez)
- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (Haoran Jiang)
- bpf: fix possible endless loop in BPF map iteration (Brandon Kammerdiener)
- io_uring: don't duplicate flushing in io_req_post_cqe (Pavel Begunkov)
- block: fix race between set_blocksize and read paths (Darrick J. Wong) [Orabug: 38095117] {CVE-2025-38073}
- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (Ihor Solodrai)
- drm/amdgpu: Allow P2P access through XGMI (Felix Kuehling)
- drm/amd/display: Enable urgent latency adjustment on DCN35 (Nicholas Susanto)
- fs/ext4: use sleeping version of sb_find_get_block() (Davidlohr Bueso)
- fs/jbd2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/ocfs2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: introduce sleeping flavors for pagecache lookups (Davidlohr Bueso)
- fs/buffer: split locking for pagecache lookups (Davidlohr Bueso)
- ima: process_measurement() needlessly takes inode_lock() on MAY_READ (Frederick Lawler)
- dma-mapping: Fix warning reported for missing prototype (Balbir Singh)
- net: enetc: refactor bulk flipping of RX buffers to separate function (Vladimir Oltean)
- vhost_task: fix vhost_task_create() documentation (Stefano Garzarella)
- cgroup: Fix compilation issue due to cgroup_mutex not being exported (Gao Xu)
- dma-mapping: avoid potential unused data compilation warning (Marek Szyprowski)
- mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type (Hans de Goede)
- intel_th: avoid using deprecated page-&gt;mapping, index fields (Lorenzo Stoakes)
- dma/mapping.c: dev_dbg support for dma_addressing_limited (Balbir Singh)
- virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han) [Orabug: 38094958] {CVE-2025-38048}
- scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices (Manish Pandey)
- scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [Orabug: 38095134] {CVE-2025-38075}
- nvmem: qfprom: switch to 4-byte aligned reads (Dmitry Baryshkov)
- nvmem: core: update raw_len if the bit reading is required (Dmitry Baryshkov)
- nvmem: core: verify cell's raw_len (Dmitry Baryshkov)
- nvmem: core: fix bit offsets of more than one byte (Dmitry Baryshkov)
- nvmem: rockchip-otp: add rk3576 variant data (Heiko Stuebner)
- nvmem: rockchip-otp: Move read-offset into variant-data (Heiko Stuebner)
- cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist (Pengyu Luo)
- phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Move IRQ request in probe (Claudiu Beznea)
- i2c: designware: Fix an error handling path in i2c_dw_pci_probe() (Christophe Jaillet)
- i2c: designware: Use temporary variable for struct device (Andy Shevchenko)
- drm/amd/display: Defer BW-optimization-blocked DRR adjustments (John Olender)
- drm/amd/display: Correct timing_adjust_pending flag setting. (Zhongwei)
- drm/amd/display: Do not enable replay when vtotal update is pending. (Sung-Huai Wang)
- drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401 (Dillon Varone)
- LTS version: v6.12.30 (Jack Vogel)
- drm/amdgpu: fix pm notifier handling (Alex Deucher)
- phy: tegra: xusb: remove a stray unlock (Dan Carpenter)
- usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977018] {CVE-2025-37967}
- drm/tiny: panel-mipi-dbi: Use drm_client_setup_with_fourcc() (Fabio Estevam)
- drm/panel-mipi-dbi: Run DRM default client setup (Thomas Zimmermann)
- drm/fbdev-dma: Support struct drm_driver.fbdev_probe (Thomas Zimmermann)
- Bluetooth: btnxpuart: Fix kernel panic during FW release (Neeraj Sanjay Kale) [Orabug: 37844459] {CVE-2025-22102}
- iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977026] {CVE-2025-37968}
- accel/ivpu: Fix fw log printing (Jacek Lawrynowicz)
- accel/ivpu: Refactor functions in ivpu_fw_log.c (Jacek Lawrynowicz)
- accel/ivpu: Reset fw log on cold boot (Tomasz Rusinowicz)
- accel/ivpu: Rename ivpu_log_level to fw_log_level (Jacek Lawrynowicz)
- mm/page_alloc: fix race condition in unaccepted memory handling (Kirill A. Shutemov) [Orabug: 38094767] {CVE-2025-38008}
- drm/xe/gsc: do not flush the GSC worker from the reset path (Daniele Ceraolo Spurio)
- CIFS: New mount option for cifs.upcall namespace resolution (Ritvik Budhiraja)
- dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (Shuai Xue) [Orabug: 38094790] {CVE-2025-38014}
- dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094793] {CVE-2025-38015}
- dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call (Shuai Xue)
- dmaengine: idxd: Add missing cleanups in cleanup internals (Shuai Xue)
- dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs (Shuai Xue)
- dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy (Yemike Abhilash Chandra)
- dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094756] {CVE-2025-38005}
- mm: userfaultfd: correct dirty flags set for both present and swap pte (Barry Song)
- net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
- ring-buffer: Fix persistent buffer when commit page is the reader page (Steven Rostedt)
- wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094770] {CVE-2025-38009}
- tpm: Mask TPM RC in tpm2_start_auth_session() (Jarkko Sakkinen)
- spi: tegra114: Use value to check for invalid delays (Aaron Kling)
- smb: client: fix memory leak during error handling for POSIX mkdir (Jethro Donaldson)
- scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer (Steve Siwinski)
- phy: renesas: rcar-gen3-usb2: Set timing registers only once (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind (Claudiu Beznea)
- phy: Fix error handling in tegra_xusb_port_init (Ma Ke)
- phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking (Wayne Chang) [Orabug: 38094777] {CVE-2025-38010}
- tracing: samples: Initialize trace_array_printk() with the correct function (Steven Rostedt)
- ftrace: Fix preemption accounting for stacktrace filter command (Donglin Peng)
- ftrace: Fix preemption accounting for stacktrace trigger command (Donglin Peng)
- kbuild: Disable -Wdefault-const-init-unsafe (Nathan Chancellor)
- Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer() (Michael Kelley)
- Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (Michael Kelley)
- arm64: dts: rockchip: Remove overdrive-mode OPPs from RK3588J SoC dtsi (Dragan Simic)
- arm64: dts: amlogic: dreambox: fix missing clkc_audio node (Christian Hewitt)
- hv_netvsc: Remove rmsg_pgcnt (Michael Kelley)
- hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (Michael Kelley)
- hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (Michael Kelley)
- dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi)
- ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera (Nicolas Chauvet)
- ALSA: usb-audio: Add sample rate quirk for Audioengine D1 (Christian Heusel)
- ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() (Xu Wang)
- ACPI: PPTT: Fix processor subtable walk (Jeremy Linton)
- gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
- MAINTAINERS: Update Alexey Makhalov's email address (Alexey Makhalov)
- drm/amd/display: Avoid flooding unnecessary info messages (Wayne Lin)
- drm/amd/display: Correct the reply value when AUX write incomplete (Wayne Lin)
- drm/amdgpu: csa unmap use uninterruptible lock (Philip Yang) [Orabug: 38094779] {CVE-2025-38011}
- drm/amdgpu: fix incorrect MALL size for GFX1151 (Tim Huang)
- Revert "drm/amd/display: Hardware cursor changes color when switched to software cursor" (Melissa Wen)
- btrfs: add back warning for mount option commit values exceeding 300 (Kyoji Ogasawara)
- btrfs: fix folio leak in submit_one_async_extent() (Boris Burkov)
- btrfs: fix discard worker infinite loop after disabling discard (Filipe Manana)
- LoongArch: uprobes: Remove redundant code about resume_era (Tiezhu Yang)
- LoongArch: uprobes: Remove user_{en,dis}able_single_step() (Tiezhu Yang)
- LoongArch: Fix MAX_REG_OFFSET calculation (Huacai Chen)
- LoongArch: Save and restore CSR.CNTC for hibernation (Huacai Chen)
- LoongArch: Move __arch_cpu_idle() to .cpuidle.text section (Huacai Chen)
- LoongArch: Prevent cond_resched() occurring within kernel-fpu (Tianyang Zhang)
- HID: bpf: abort dispatch if device destroyed (Rongrong) [Orabug: 38094796] {CVE-2025-38016}
- udf: Make sure i_lenExtents is uptodate on inode eviction (Jan Kara)
- sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator (Tejun Heo) [Orabug: 38094786] {CVE-2025-38012}
- dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" (Nathan Lynch)
- NFSv4/pnfs: Reset the layout state after a layoutreturn (Trond Myklebust)
- tsnep: fix timestamping with a stacked DSA driver (Gerhard Engleder)
- net/tls: fix kernel panic when alloc_page failed (Pengtao He) [Orabug: 38094802] {CVE-2025-38018}
- mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (Ido Schimmel) [Orabug: 38094804] {CVE-2025-38019}
- wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request (Kees Cook) [Orabug: 38094788] {CVE-2025-38013}
- octeontx2-pf: Do not reallocate all ntuple filters (Subbaraya Sundeep)
- octeontx2-af: Fix CGX Receive counters (Hariprasad Kelam)
- net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability (Bc-Bocun Chen)
- octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy (Subbaraya Sundeep)
- netlink: specs: tc: all actions are indexed arrays (Jakub Kicinski)
- netlink: specs: tc: fix a couple of attribute names (Jakub Kicinski)
- drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value (Umesh Nerlige Ramappa)
- regulator: max20086: fix invalid memory access (Cosmin Tanislav) [Orabug: 38094833] {CVE-2025-38027}
- qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() (Abdun Nihaal)
- net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094808] {CVE-2025-38020}
- vsock/test: Fix occasional failure in SIOCOUTQ tests (Konstantin Shkolnyy)
- net: dsa: b53: prevent standalone from trying to forward to other ports (Jonas Gorski)
- ALSA: sh: SND_AICA should depend on SH_DMA_API (Geert Uytterhoeven)
- nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (Keith Busch)
- nvme-pci: make nvme_pci_npages_prp() __always_inline (Kees Cook)
- net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING (Vladimir Oltean)
- net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe)
- ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info (Takashi Iwai)
- ALSA: seq: Fix delivery of UMP events to group ports (Takashi Iwai)
- net: mctp: Ensure keys maintain only one ref to corresponding dev (Andrew Jeffery)
- tests/ncdevmem: Fix double-free of queue array (Cosmin Ratiu)
- selftests: ncdevmem: Switch to AF_INET6 (Stanislav Fomichev)
- selftests: ncdevmem: Make client_ip optional (Stanislav Fomichev)
- selftests: ncdevmem: Unify error handling (Stanislav Fomichev)
- selftests: ncdevmem: Separate out dmabuf provider (Stanislav Fomichev)
- selftests: ncdevmem: Redirect all non-payload output to stderr (Stanislav Fomichev)
- net: mctp: Don't access ifa_index when missing (Matt Johnston)
- mctp: no longer rely on net-&gt;dev_index_head[] (Eric Dumazet)
- tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing (Hangbin Liu)
- net_sched: Flush gso_skb list too during -&gt;change() (Cong Wang) [Orabug: 37998128] {CVE-2025-37992}
- Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags (Luiz Augusto von Dentz)
- RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Zhu Yanjun) [Orabug: 38094813] {CVE-2025-38022}
- spi: loopback-test: Do not split 1024-byte hexdumps (Geert Uytterhoeven)
- nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094818] {CVE-2025-38023}
- HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 38094764] {CVE-2025-38007}
- HID: thrustmaster: fix memory leak in thrustmaster_interrupts() (Qasim Ijaz)
- RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094827] {CVE-2025-38024}
- virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx (Koichiro Den)
- virtio_ring: add a func argument 'recycle_done' to virtqueue_reset() (Koichiro Den)
- iio: chemical: sps30: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7768-1: Fix insufficient alignment of timestamp. (Jonathan Cameron)
- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
- xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
- Revert "drm/amd: Stop evicting resources on APUs in suspend" (Alex Deucher)
- drm/amd: Add Suspend/Hibernate notification callback support (Mario Limonciello)
- iio: pressure: mprls0025pa: use aligned_s64 for timestamp (David Lechner)
- iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7266: Fix potential timestamp alignment issue. (Jonathan Cameron)
- KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (Sean Christopherson)
- KVM: Add member to struct kvm_gfn_range to indicate private/shared (Isaku Yamahata)
- uio_hv_generic: Fix sysfs creation path for ring buffer (Naman Jain)
- tpm: tis: Double the timeout B to 4s (Michal Suchanek)
- tracing: probes: Fix a possible race in trace_probe_log APIs (Masami Hiramatsu)
- cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks (Waiman Long)
- arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout (Himanshu Bhavani)
- platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection (Hans de Goede)
- platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL) (Runhua He)
- binfmt_elf: Move brk for static PIE even if ASLR disabled (Kees Cook)
- riscv: dts: sophgo: fix DMA data-width configuration for CV18xx (Ze Huang)
- drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies (Mario Limonciello)
- drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC Policies (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list to always include security.* xattrs (Stephen Smalley)
- arm64: dts: rockchip: Assign RT5616 MCLK rate on rk3588-friendlyelec-cm3588 (Tom Vincent)
- LTS version: v6.12.29 (Jack Vogel)
- arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977004] {CVE-2025-37963}
- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976926] {CVE-2025-37948}
- arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
- arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
- arm64: insn: Add support for encoding DSB (James Morse)
- mm: page_alloc: speed up fallbacks in rmqueue_bulk() (Johannes Weiner)
- mm: page_alloc: don't steal single pages from biggest buddy (Johannes Weiner)
- Bluetooth: btmtk: Remove the resetting step before downloading the fw (Hao Qin)
- Bluetooth: btmtk: Remove resetting mt7921 before downloading the fw (Hao Qin)
- io_uring: always arm linked timeouts prior to issue (Jens Axboe)
- rust: clean Rust 1.88.0's `clippy::uninlined_format_args` lint (Miguel Ojeda)
- rust: allow Rust 1.87.0's `clippy::ptr_eq` lint (Miguel Ojeda)
- Revert "um: work around sched_yield not yielding in time-travel mode" (Christian Lamparter)
- do_umount(): add missing barrier before refcount checks in sync case (Al Viro)
- io_uring/sqpoll: Increase task_work submission batch size (Gabriel Krisman Bertazi)
- drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs (Tejas Upadhyay)
- drm/xe/tests/mocs: Update xe_force_wake_get() return handling (Himal Prasad Ghimiray)
- riscv: misaligned: enable IRQs while handling misaligned accesses (Clément Léger)
- riscv: misaligned: factorize trap handling (Clément Léger)
- nvme: unblock ctrl state transition for firmware update (Daniel Wagner)
- drm/panel: simple: Update timings for AUO G101EVN010 (Kevin Baker)
- loop: Add sanity check for read/write_iter (Lizhi Xu)
- loop: factor out a loop_assign_backing_file helper (Christoph Hellwig)
- loop: refactor queue limits updates (Christoph Hellwig)
- loop: Fix ABBA locking race (Ogawa Hirofumi)
- loop: Simplify discard granularity calc (John Garry)
- loop: Use bdev limit helpers for configuring discard (John Garry)
- riscv: misaligned: Add handling for ZCB instructions (Nylon Chen)
- MIPS: Fix MAX_REG_OFFSET (Thorsten Blum)
- iio: adc: dln2: Use aligned_s64 for timestamp (Jonathan Cameron)
- iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64 (Jonathan Cameron)
- types: Complement the aligned types with signed 64-bit one (Andy Shevchenko)
- iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer. (Jonathan Cameron)
- iio: accel: adxl367: fix setting odr for activity time update (Lothar Rubusch)
- usb: usbtmc: Fix erroneous generic_read ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous wait_srq ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous get_stb ioctl error returns (Dave Penkler)
- USB: usbtmc: use interruptible sleep in usbtmc_read (Oliver Neukum)
- usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015126] {CVE-2025-37994}
- usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition (Rd Babiera)
- usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs (Lukasz Czechowski)
- usb: host: tegra: Prevent host controller crash when OTG port is used (Jim Lin)
- usb: gadget: Use get_status callback to set remote wakeup capability (Prashanth K)
- usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN (Wayne Chang)
- usb: gadget: f_ecm: Add get_status callback (Prashanth K)
- usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version (Pawel Laszczak)
- usb: cdnsp: Fix issue with resuming from L1 (Pawel Laszczak)
- usb: dwc3: gadget: Make gadget_wakeup asynchronous (Prashanth K)
- x86/microcode: Consolidate the loader enablement checking (Borislav Petkov)
- module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015131] {CVE-2025-37995}
- memblock: Accept allocated memory before use in memblock_double_array() (Tom Lendacky) [Orabug: 37976994] {CVE-2025-37960}
- clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() (Sebastian Andrzej Siewior)
- arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong idmap generation (Levi Yun)
- accel/ivpu: Increase state dump msg timeout (Jacek Lawrynowicz)
- xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976934] {CVE-2025-37949}
- xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it (John Ernberg)
- smb: client: Avoid race in open_cached_dir with lease breaks (Paul Aurich) [Orabug: 37976959] {CVE-2025-37954}
- usb: uhci-platform: Make the clock really optional (Alexey Charkov)
- drm/amdgpu/hdp7: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amd/display: Copy AUX read reply data whenever length &gt; 0 (Wayne Lin)
- drm/amd/display: Fix wrong handling for AUX_DEFER case (Wayne Lin)
- drm/amd/display: Remove incorrect checking in dmub aux handler (Wayne Lin)
- drm/amd/display: Fix the checking condition in dmub aux handling (Wayne Lin)
- drm/amd/display: more liberal vmin/vmax update for freesync (Aurabindo Pillai)
- drm/amd/display: Fix invalid context error in dml helper (Roman Li) [Orabug: 37977185] {CVE-2025-37965}
- drm/amdgpu/vcn: using separate VCN1_AON_SOC offset (Ruijing Dong)
- drm/xe: Add page queue multiplier (Matthew Brost)
- drm/v3d: Add job to pending list if the reset was skipped (Maíra Canal) [Orabug: 37976942] {CVE-2025-37951}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug: 37977031] {CVE-2025-37969}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977037] {CVE-2025-37970}
- iio: imu: inv_mpu6050: align buffer for timestamp (David Lechner)
- iio: adis16201: Correct inclinometer channel resolution (Gabriel)
- iio: adc: rockchip: Fix clock initialization sequence (Simon Xue)
- iio: adc: ad7606: fix serial register access (Angelo Dureghello)
- io_uring: ensure deferred completions are flushed for multishot (Jens Axboe)
- drm/amd/display: Shift DMUB AUX reply command if necessary (Wayne Lin)
- KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (Mikhail Lobanov) [Orabug: 37976977] {CVE-2025-37957}
- selftests/mm: fix a build failure on powerpc (Nysal Jan K.A.)
- selftests/mm: compaction_test: support platform with huge mount of memory (Feng Tang)
- mm/userfaultfd: fix uninitialized output field for -EAGAIN race (Peter Xu)
- mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976982] {CVE-2025-37958}
- mm: fix folio_pte_batch() on XEN PV (Petr Vaněk)
- x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (Dave Hansen) [Orabug: 37977013] {CVE-2025-37964}
- staging: axis-fifo: Correct handling of tx_fifo_depth for size validation (Gabriel)
- staging: axis-fifo: Remove hardware resets for user errors (Gabriel)
- staging: bcm2835-camera: Initialise dev in v4l2_dev (Dave Stevenson) [Orabug: 37977042] {CVE-2025-37971}
- staging: iio: adc: ad7816: Correct conditional logic for store mode (Gabriel)
- rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.87.0 (Miguel Ojeda)
- rust: clean Rust 1.88.0's `unnecessary_transmutes` lint (Miguel Ojeda)
- Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 (Aditya Garg)
- Input: synaptics - enable SMBus for HP Elitebook 850 G1 (Dmitry Torokhov)
- Input: synaptics - enable InterTouch on Dell Precision M3800 (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30L-G (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30-D (Manuel Fombuena)
- Input: xpad - fix two controller table values (Vicki Pfau)
- Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller (Lode Willems)
- Input: xpad - fix Share button on Xbox One controllers (Vicki Pfau)
- Input: mtk-pmic-keys - fix possible null pointer dereference (Gary Bisson) [Orabug: 37977044] {CVE-2025-37972}
- Input: cyttsp5 - fix power control issue on wakeup (Mikael Gonella-Bolduc)
- Input: cyttsp5 - ensure minimum reset pulse width (Hugo Villeneuve)
- virtio-net: fix total qstat values (Jakub Kicinski)
- net: export a helper for adding up queue stats (Jakub Kicinski)
- fbnic: Do not allow mailbox to toggle to ready outside fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Pull fbnic_fw_xmit_cap_msg use out of interrupt context (Alexander Duyck)
- fbnic: Improve responsiveness of fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Actually flush_tx instead of stalling out (Alexander Duyck)
- fbnic: Gate AXI read/write enabling on FW mailbox (Alexander Duyck)
- fbnic: Fix initialization of mailbox descriptor rings (Alexander Duyck)
- net: dsa: b53: do not set learning and unicast/multicast on up (Jonas Gorski)
- net: dsa: b53: fix learning on VLAN unaware bridges (Jonas Gorski)
- net: dsa: b53: fix toggling vlan_filtering (Jonas Gorski)
- net: dsa: b53: do not program vlans when vlan filtering is off (Jonas Gorski)
- net: dsa: b53: do not allow to configure VLAN 0 (Jonas Gorski)
- net: dsa: b53: always rejoin default untagged VLAN on bridge leave (Jonas Gorski)
- net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave (Jonas Gorski)
- net: dsa: b53: fix flushing old pvid VLAN on pvid change (Jonas Gorski)
- net: dsa: b53: fix clearing PVID of a port (Jonas Gorski)
- net: dsa: b53: keep CPU port always tagged again (Jonas Gorski)
- net: dsa: b53: allow leaky reserved multicast (Jonas Gorski)
- bpf: Scrub packet on bpf_redirect_peer (Paul Chaignon) [Orabug: 37976990] {CVE-2025-37959}
- netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015141] {CVE-2025-37997}
- ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [Orabug: 37976996] {CVE-2025-37961}
- erofs: ensure the extra temporary copy is valid for shortened bvecs (Gao Xiang)
- ice: use DSN instead of PCI BDF for ice_adapter index (Przemek Kitszel)
- ice: Initial support for E825C hardware in ice_adapter (Sergey Temerkhanov)
- wifi: mac80211: fix the type of status_code for negotiated TID to Link Mapping (Michael-Cy Lee)
- can: gw: fix RCU/BH usage in cgw_create_job() (Oliver Hartkopp)
- can: mcp251xfd: fix TDC setting for low data bit rates (Kelsey Maes)
- can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe (Antonios Salios) [Orabug: 38015123] {CVE-2025-37993}
- net: ethernet: mtk_eth_soc: do not reset PSE when setting FE (Frank Wunderlich)
- net: ethernet: mtk_eth_soc: reset all TX queues on DMA free (Daniel Golle)
- gre: Fix again IPv6 link-local address generation. (Guillaume Nault)
- virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (Jakub Kicinski) [Orabug: 37976969] {CVE-2025-37955}
- virtio_net: xsk: bind/unbind xsk for tx (Xuan Zhuo)
- sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 37977176] {CVE-2025-37953}
- s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
- ksmbd: fix memory leak in parse_lease_state() (Zhaolong Wang) [Orabug: 37977180] {CVE-2025-37962}
- openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015148] {CVE-2025-37998}
- ksmbd: Fix UAF in __close_file_table_ids (Sean Heelan) [Orabug: 37976951] {CVE-2025-37952}
- ksmbd: prevent out-of-bounds stream writes by validating *pos (Norbert Szetei) [Orabug: 37976923] {CVE-2025-37947}
- ksmbd: prevent rename with empty string (Namjae Jeon) [Orabug: 37976972] {CVE-2025-37956}
- can: rockchip_canfd: rkcanfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Niklas Schnelle) [Orabug: 37976920] {CVE-2025-37946}
- vfio/pci: Align huge faults to order (Alex Williamson)
- wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation (Veerendranath Jakkam) [Orabug: 37977046] {CVE-2025-37973}
- s390/pci: Fix missing check for zpci_create_device() error return (Niklas Schnelle) [Orabug: 37977050] {CVE-2025-37974}
- can: mcan: m_can_class_unregister(): fix order of unregistration calls (Marc Kleine-Budde)
- firmware: arm_scmi: Fix timeout checks on polling path (Cristian Marussi)
- arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2 (Wojciech Dubowik)
- Revert "btrfs: canonicalize the device path before adding it" (Qu Wenruo)
- fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (Max Kellermann) [Orabug: 38015155] {CVE-2025-37999}
- dm: add missing unlock on in dm_keyslot_evict() (Dan Carpenter)
- mm/vmscan: wake up flushers conditionally to avoid cgroup OOM (Zeng Jingxiang) [Orabug: 37480932]
- dmaengine: idxd: Narrow the restriction on BATCH to ver. 1 only (Vinicius Costa Gomes) [Orabug: 37801355]
- uek-rpm: build the fwctl mlx5 driver on UEK (Qing Huang) [Orabug: 37810636]
- fwctl: Adapt upstream code for UEK8 (Mikhael Goikhman) [Orabug: 37810636]
- mlx5: Create an auxiliary device for fwctl_mlx5 (Saeed Mahameed) [Orabug: 37810636]
- fwctl/mlx5: Support for communicating with mlx5 fw (Saeed Mahameed) [Orabug: 37810636]
- fwctl: Add documentation (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware (Jason Gunthorpe) [Orabug: 37810636]
- taint: Add TAINT_FWCTL (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_INFO to return basic information about the device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Basic ioctl dispatch for the character device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Add basic structure for a class subsystem with a cdev (Jason Gunthorpe) [Orabug: 37810636]
- Revert "fwctl: Add basic structure for a class subsystem with a cdev" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Basic ioctl dispatch for the character device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_INFO to return basic information about the device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Support for communicating with mlx5 fw" (Qing Huang) [Orabug: 37810636]
- Revert "mlx5: Create an auxiliary device for fwctl_mlx5" (Qing Huang) [Orabug: 37810636]
- Revert "taint: Add TAINT_FWCTL" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Adapt code for UEK-NEXT" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Add INTERNAL_DEV_RES uctx capability" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Allow up to 4k devices" (Qing Huang) [Orabug: 37810636]
- Revert "uek-rpm: build the fwctl mlx5 driver on UEK" (Qing Huang) [Orabug: 37810636]
- dmaengine: idxd: Change err messages to dbg (Jack Vogel) [Orabug: 37841831]
- PCI: Add PCI_VDEVICE_SUB helper macro (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbevf: Add support for Intel(R) E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Enable link management in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Clean up the E610 link management related code (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add ixgbe_x540 multiple header inclusion protection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for EEPROM dump in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for NVM handling in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add link management support for E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 device capabilities detection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 FW Admin Command Interface (Piotr Kwapulinski) [Orabug: 37889575]
- uek-rpm: Move the gve kernel module from extra to kernel-uek-core (Samasth Norway Ananda) [Orabug: 37940897]
- uek-rpm/config-aarch64: Enable BT_HCIUART_BCM for RPi Bluetooth (Vijay Kumar) [Orabug: 37961540]
- platform/mellanox: mlxbf-pmc: Support additional PMC blocks (Shravan Kumar Ramani) [Orabug: 37964051]
- mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug: 37964051,38037120] {CVE-2025-37866}
- mlxbf-bootctl: Support sysfs entries for RTC battery status (Xiangrong Li) [Orabug: 37964051]
- platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37964051]
- uek-rpm: CONFIG_PTP_1588_CLOCK_OCP enable for OCI (Vijayendra Suman) [Orabug: 37966384]
- x86/its: Fix build errors when CONFIG_MODULES=n (Eric Biggers) [Orabug: 37970148]
- x86/its: Use dynamic thunks for indirect branches (Peter Zijlstra) [Orabug: 37970148]
- x86/ibt: Keep IBT disabled during alternative patching (Pawan Gupta) [Orabug: 37970148]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 37989268]
- amd_hsmp: Increase the SMU timeout to 500ms (Vijay Kumar) [Orabug: 38000074]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge)  [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang)  [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming)  [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams)  [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson)  [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley)  [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson)  [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson)  [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang)  [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang)  [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang)  [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang)  [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang)  [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang)  [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie)  [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie)  [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen)  [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen)  [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda)  [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda)  [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.1.el10uek]" date="1750939200">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.2.el10uek]" date="1752148800">- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38178286]  {CVE-2025-38089}
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38162790]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38175263]
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)  [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)  [Orabug: 38175246]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.3.el10uek]" date="1752494400">- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38171405]</changelog>
</package>
<package pkgid="6d6fc2d7e51c7b928ad9e46b0b6574fbe71b34b3" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="102.36.5.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge) [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang) [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming) [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams) [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson) [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley) [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson) [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson) [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang) [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang) [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang) [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang) [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang) [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang) [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie) [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie) [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen) [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen) [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda) [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda) [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger)  [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan)  [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan)  [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin)
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota)
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu)
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng)
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann)
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo)
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov)
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu)
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi)
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung)
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei Zhang)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Wentao Liang)
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold)
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-ji Chen)
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu)
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett)
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana)
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li (Intel))
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells)
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara)
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko)
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima)
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai)
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee)
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima)
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet)
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer)
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai)
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin)
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (SeongJae Park)
- smb: client: remove 	 from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima)
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski)
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev)
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo)
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski)
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang)
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin.Cao)
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng)
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke)
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun)
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (FUJITA Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin KaFai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu)
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra)
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher)
- smb: client: fix first command failure during re-negotiation (zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich)
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet)
- net: atm: add lec_mutex (Eric Dumazet)
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima)
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg)
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev)
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski)
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu)
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima)
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima)
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov)
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo)
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh AP)
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon)
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka)
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders)
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sá)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott)
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath SM)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal)
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn)
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis)
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam)
- Input: sparcspkr - avoid unannotated fall-through (WangYuli)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar)
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima)
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rong Zhang)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon)
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li (Intel))
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski)
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet)
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath SM)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin)
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov)
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang)
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton)
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes)
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook)
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Wentao Liang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij)
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo)
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner)
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu)
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh AP)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso)
- f2fs: fix to bail out in get_new_segment() (Chao Yu)
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski)
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R)
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin)
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao)
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S)
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (gldrk)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han)
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han)
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn)
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos)
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang)
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang)
- regulator: max14577: Add error check for max14577_read_reg() (Wentao Liang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel Shahrouzi)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann)
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz)
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin)
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Wentao Liang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Wentao Liang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams)
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'ichiro Kawasaki)
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park)
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (GONG Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu)
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim)
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski)
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han)
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu)
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim)
- f2fs: fix to do sanity check on ino and xnid (Chao Yu)
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter)
- ext4: only dirty folios when data journaling regular files (Brian Foster)
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo)
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis)
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko)
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin)
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeff Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar)
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski)
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian)
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev)
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis)
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li)
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Wentao Liang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis)
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park)
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann)
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng)
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (NeilBrown)
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh)
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter)
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Wentao Liang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Wentao Liang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Wentao Liang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F. R. A. Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li (Intel))
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner)
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov)
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt)
- 9p: Add a migrate_folio method (Matthew Wilcox (Oracle))
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (RD Babiera)
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby (SUSE))
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Wupeng Ma)
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard)
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov)
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge)
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox (Oracle))
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox (Oracle))
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig)
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang)
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana)
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski)
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet)
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet)
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet)
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin)
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz)
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski)
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski)
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj)
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui)
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani (IBM))
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet)
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang)
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park)
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz)
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav)
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold)
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro)
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki NAGAO)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski)
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel)
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal)
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari)
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song)
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng)
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré)
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré)
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak)
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas)
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen)
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Yeoreum Yun)
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz)
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (WangYuli)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang)
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin)
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar)
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin)
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang)
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng)
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe JAILLET)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe JAILLET)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski)
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin)
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov)
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin)
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov)
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin)
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei)
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Wentao Liang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher)
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F. R. A. Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo)
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima)
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam)
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur)
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang)
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (KaFai Wan)
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein)
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich)
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen)
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook)
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li RongQing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin)
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin)
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný)
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (ping.gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen)
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu)
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu)
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev)
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring (Arm))
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen)
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko)
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin)
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (YiFei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad)
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso)
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang)
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan)
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma)
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen XIN)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen XIN)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu)
- f2fs: prevent the current section from being selected as a victim during GC (yohan.joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter)
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu)
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen)
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen)
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang)
- xen/x86: fix initial memory balloon target (Roger Pau Monne)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon)
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A. R. Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin)
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe JAILLET)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao)
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao)
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland)
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown)
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han)
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian)
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo)
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot)
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong)
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu)
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F. R. A. Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu (Google))
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby (SUSE))
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait)
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper)
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli)  [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha)  [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137447]  {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky)  [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli)  [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly)  [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry)  [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson)  [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson)  [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry)  [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry)  [Orabug: 38026089]
- xfs: update atomic write limits (John Garry)  [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry)  [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry)  [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry)  [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry)  [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry)  [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong)  [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong)  [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry)  [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong)  [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry)  [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong)  [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong)  [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig)  [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig)  [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry)  [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry)  [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry)  [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry)  [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry)  [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry)  [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry)  [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry)  [Orabug: 38026089]
- dm-table: atomic writes support (John Garry)  [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry)  [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry)  [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry)  [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry)  [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry)  [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry)  [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry)  [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry)  [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry)  [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry)  [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry)  [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry)  [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry)  [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry)  [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry)  [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry)  [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen)  [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge)  [Orabug: 38137957]
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge)  [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge)  [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna)  [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju)  [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.1.el10uek]" date="1754481600">- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann)  [Orabug: 38217337]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.2.el10uek]" date="1755086400">- iommu/vt-d: Fix misplaced domain_attached assignment (Ban ZuoXiang)  [Orabug: 38294635]</changelog>
</package>
<package pkgid="2516a7d9726fa3f6e9963bcb1eaf3c8eeb67b2d1" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger) [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo) [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan) [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan) [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
</package>
<package pkgid="3b127181ee770a3c12712b9e92909d46f45882ce" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]  
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
</package>
<package pkgid="99353e6a9d03c5564aa877399a6130c7af86d09b" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560} 
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500} 
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566} 
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571} 
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618} 
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
</package>
<package pkgid="543eef2eeb0eb345bf9fadcd20c60ff58b2dbcda" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560}
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500}
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566}
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571}
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618}
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.4.el10uek]" date="1759492800">- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton)  [Orabug: 38500610]  {CVE-2025-38724} 
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38500621]  {CVE-2025-39698} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38500629]  {CVE-2025-39881} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38500632]  {CVE-2025-39866}</changelog>
</package>
<package pkgid="13791cb2a292770a15c59a12db983e7e962990c1" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="104.43.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
</package>
<package pkgid="7795b1cab71a70ee08b30331cc45b19469b61232" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="104.43.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.3.el10uek]" date="1761220800">- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38572958]  {CVE-2025-39698} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38572953]  {CVE-2025-39866} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38572951]  {CVE-2025-3988} 
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon)  [Orabug: 38572950]  {CVE-2025-39718} 
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38572948]  {CVE-2025-39964} 
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)  [Orabug: 38572947]  {CVE-2025-39963} 
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)  [Orabug: 38572946]  {CVE-2025-39965} 
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski)  [Orabug: 38572944]  {CVE-2025-39946} 
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)  [Orabug: 38572943]  {CVE-2025-39977} 
- i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38572941]  {CVE-2025-39973}</changelog>
</package>
<package pkgid="de3a927fbb33296bd7a9a3756cb30f21ae983667" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="105.51.5.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)
- media: rc: fix races with imon_disconnect() (Larshin Sergey)
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik)
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)
- i40e: add validation for ring_len param (Lukasz Czapnik)
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.1.el10uek]" date="1764590400">- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu)  [Orabug: 38712788]  {CVE-2025-40019} 
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712786]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="c6fc44eecae5ef40c5b7d3e370f8ec708ba7adda" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="105.51.5.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]  
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]  
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]  
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]  
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]  
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]  
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]  
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]  
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]  
- LTS version: v6.12.51 (Jack Vogel)   
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)   
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)   
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)   
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)   
- media: rc: fix races with imon_disconnect() (Larshin Sergey)   
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)   
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)   
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)   
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)   
- crypto: sha256 - fix crash at kexec (Breno Leitao)   
- LTS version v6.12.50 (Jack Vogel)   
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)   
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)   
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)   
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)   
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)   
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)   
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)   
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)   
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)   
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)   
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)   
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)   
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)   
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)   
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))   
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)   
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)   
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)   
- i40e: add max boundary check for VF filters (Lukasz Czapnik)   
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)   
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)   
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)   
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)   
- i40e: add validation for ring_len param (Lukasz Czapnik)   
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)   
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)   
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)   
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)   
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)   
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)   
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)   
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)   
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)   
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)   
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)   
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)   
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)   
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)   
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)   
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)   
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)   
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)   
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)   
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)   
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)   
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)   
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)   
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)   
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)   
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)   
- wifi: virt_wifi: Fix page fault on connect (James Guan)   
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)   
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)   
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)   
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)   
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)   
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)   
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)   
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)   
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)   
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)   
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)   
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)   
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)   
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)   
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)   
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)   
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)   
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)   
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)   
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)   
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)   
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)   
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)   
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)   
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)   
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
</package>
<package pkgid="556837a747785cd3eb1d17b3d5a523837c9291dc" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="106.55.4.1.el10uek"/>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="804478ff2f9aabea26166d058b81e59e9014aed9" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="106.55.4.2.el10uek"/>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.2.el10uek]" date="1766145600">- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)   {CVE-2025-40271} 
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="0a8f17dc0230cf5af35719455b52337e96f401ef" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="b25c3d2f3f212e23ddeaad27e32473647767b4e8" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
</package>
<package pkgid="3a486ae6e6779132a3328e25c488f55f7744fb2f" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.4.el10uek]" date="1770292800">- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet)  [Orabug: 38932996]  {CVE-2025-40257} 
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38932973]  {CVE-2025-40149} 
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet)  [Orabug: 38932955]  {CVE-2025-40258} 
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38932939]</changelog>
</package>
<package pkgid="4049251ae022b581533c746b6f896cbbd6a1964d" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="108.64.6.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge) [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp) [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal) [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.62.1.el10uek]" date="1765886400">- uek-rpm: Allow disabling kabichk at command line (Yifei Liu) [Orabug: 38733049]
- Revert "xfrm: Use xdo.dev instead of xdo.real_dev" (Jack Vogel) [Orabug: 38718730]
- Revert "net/mlx5: Fix IPsec cleanup over MPV device" (Jack Vogel) [Orabug: 38718730]
- LTS version: v6.12.62 (Jack Vogel)
- bus: mhi: host: pci_generic: Add Telit FN990B40 modem support (Daniele Palmas)
- bus: mhi: host: pci_generic: Add Telit FN920C04 modem support (Daniele Palmas)
- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (Navaneeth K)
- staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (Navaneeth K)
- staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (Navaneeth K)
- comedi: check device's attached status in compat ioctls (Nikita Zhandarovich)
- comedi: multiq3: sanitize config options in multiq3_attach() (Nikita Zhandarovich)
- comedi: c6xdigio: Fix invalid PNP driver unregistration (Ian Abbott)
- wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (Zenm Chen)
- wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1 (Zenm Chen)
- samples: work around glibc redefining some of our defines wrong (Linus Torvalds)
- LoongArch: Mask all interrupts during kexec/kdump (Huacai Chen)
- HID: elecom: Add support for ELECOM M-XT3URBK (018F) (Naoki Ueki)
- platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (Antheas Kapenekakis)
- platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (Antheas Kapenekakis)
- platform/x86: huawei-wmi: add keys for HONOR models (Ston Jia)
- HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (April Grimoire)
- platform/x86: acer-wmi: Ignore backlight event (Armin Wolf)
- pinctrl: qcom: msm: Fix deadlock in pinmux configuration (Praveen Talari)
- nvme: fix admin request_queue lifetime (Keith Busch) [Orabug: 38773611] {CVE-2025-68265}
- HID: hid-input: Extend Elan ignore battery quirk to USB (Mario Limonciello)
- bfs: Reconstruct file type when loading from disk (Tetsuo Handa)
- ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (Lushih Hsieh)
- drm/amdkfd: Fix GPU mappings for APU after prefetch (Harish Kasiviswanathan)
- smb: fix invalid username check in smb3_fs_context_parse_param() (Yiqi Sun)
- Bluetooth: btrtl: Avoid loading the config file on security chips (Max Chou)
- drm/vmwgfx: Use kref in vmw_bo_dirty (Ian Forbes)
- spi: imx: keep dma request disabled before dma transfer setup (Robin Gong)
- spi: xilinx: increase number of retries before declaring stall (Alvaro Gamez Machado)
- ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() (Song Liu)
- USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- serial: add support of CPCI cards (Magne Bruno)
- USB: serial: ftdi_sio: match on interface number for jtag (Johan Hovold)
- USB: serial: option: move Telit 0x10c7 composition in the right place (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FE910C04 new compositions (Fabio Porcedda)
- USB: serial: option: add Foxconn T99W760 (Slark Xiao)
- KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (Omar Sandoval) [Orabug: 38773578] {CVE-2025-68259}
- comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (Nikita Zhandarovich)
- ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (Alexey Nepomnyashih) [Orabug: 38773586] {CVE-2025-68261}
- locking/spinlock/debug: Fix data-race in do_raw_write_lock (Alexander Sverdlin)
- ksmbd: ipc: fix use-after-free in ipc_msg_send_request (Qianchang Zhao)
- ext4: refresh inline data size before write operations (Deepanshu Kartikey) [Orabug: 38773602] {CVE-2025-68264}
- jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (Ye Bin) [Orabug: 38792632] {CVE-2025-68337}
- Documentation: process: Also mention Sasha Levin as stable tree maintainer (Bagas Sanjaya)
- xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca)
- xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)
- Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca)
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca) [Orabug: 38730491,38854317] {CVE-2025-40215}
- LTS version: v6.12.61 (Jack Vogel)
- spi: spi-nxp-fspi: Check return value of devm_mutex_init() (Thomas Weißschuh)
- drm/i915/dp: Initialize the source OUI write timestamp always (Imre Deak)
- Revert "ACPI: Suppress misleading SPCR console message when SPCR table is absent" (Punit Agrawal)
- wifi: ath12k: correctly handle mcast packets for clients (Sarika Sharma)
- net: dsa: microchip: Free previously initialized ports on init failures (Bastien Curutchet)
- net: dsa: microchip: Do not execute PTP driver code for unsupported switches (Tristram Ha)
- drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (Thomas Zimmermann) [Orabug: 38773709] {CVE-2025-68296}
- net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() (Bastien Curutchet)
- KVM: SVM: Fix redundant updates of LBR MSR intercepts (Yosry Ahmed)
- KVM: nSVM: Fix and simplify LBR virtualization handling with nested (Yosry Ahmed)
- KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() (Yosry Ahmed)
- KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts() (Yosry Ahmed)
- mm/huge_memory: fix NULL pointer deference when splitting folio (Wei Yang) [Orabug: 38773700] {CVE-2025-68293}
- usb: gadget: udc: fix use-after-free in usb_gadget_state_work (Jimmy Hu) [Orabug: 38773635] {CVE-2025-68282}
- usb: udc: Add trace event for usb_gadget_set_state (Kuen-Han Tsai)
- can: rcar_canfd: Fix CAN-FD mode as default (Biju Das)
- usb: typec: ucsi: psy: Set max current to zero when disconnected (Jameson Thies)
- nfsd: Replace clamp_t in nfsd4_get_drc_mem() (Neil Brown)
- staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann)
- libceph: replace BUG_ON with bounds check for map-&gt;max_osd (Ziming Zhang) [Orabug: 38773641] {CVE-2025-68283}
- libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773648] {CVE-2025-68284}
- libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773654] {CVE-2025-68285}
- net: dsa: microchip: Don't free uninitialized ksz_irq (Bastien Curutchet)
- net: dsa: microchip: ptp: Fix checks on irq_find_mapping() (Bastien Curutchet)
- net: dsa: microchip: common: Fix checks on irq_find_mapping() (Bastien Curutchet)
- drm/amd/display: Don't change brightness for disabled connectors (Mario Limonciello)
- drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773661] {CVE-2025-68286}
- drm/amd/amdgpu: reserve vm invalidation engine for uni_mes (Michael Chen)
- drm: sti: fix device leaks at component probe (Johan Hovold)
- USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang)
- USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov)
- xhci: dbgtty: fix device unregister (Łukasz Bartosik)
- xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman)
- xhci: fix stale flag preventig URBs after link state error is cleared (Mathias Nyman)
- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar)
- usb: dwc3: pci: Sort out the Intel device IDs (Krogerus Heikki)
- usb: dwc3: pci: add support for the Intel Nova Lake -S (Krogerus Heikki)
- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792592] {CVE-2025-68331}
- usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762728] {CVE-2025-40345}
- USB: storage: Remove subclass and protocol overrides from Novatek quirk (Alan Stern)
- usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773676] {CVE-2018-1000204,CVE-2025-68288}
- usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea)
- usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai)
- usb: cdns3: Fix double resource release in cdns3_pci_probe (Miaoqian Lin)
- most: usb: fix double free on late probe failure (Johan Hovold)
- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin)
- mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). (Kuniyuki Iwashima)
- mptcp: clear scheduled subflows on retransmit (Paolo Abeni)
- mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level (Jisheng Zhang)
- mm/memfd: fix information leak in hugetlb folios (Deepanshu Kartikey) [Orabug: 38773697] {CVE-2025-68292}
- firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli)
- nvmem: layouts: fix nvmem_layout_bus_uevent (Guan Wentao)
- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin)
- thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski)
- smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773703] {CVE-2025-68295}
- drivers/usb/dwc3: fix PCI parent check (Jamie Iles)
- dm-verity: fix unreliable memory allocation (Mikulas Patocka)
- ceph: fix crash in process_v2_sparse_read() for encrypted directories (Viacheslav Dubeyko) [Orabug: 38773716] {CVE-2025-68297}
- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde)
- can: sja1000: fix max irq loop handling (Thomas Mühlbacher)
- Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref (Douglas Anderson) [Orabug: 38773723] {CVE-2025-68298}
- atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han)
- ARM: dts: nxp: imx6ul: correct SAI3 interrupt line (Maarten Zanders)
- arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity (Xu Yang)
- arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos (Frank Li)
- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (Ivan Zhaldak)
- tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (Deepanshu Kartikey) [Orabug: 38792583] {CVE-2025-68329}
- MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow (Thomas Bogendoerfer)
- MIPS: mm: Prevent a TLB shutdown on initial uniquification (Maciej W. Rozycki)
- iio: adc: rtq6056: Correct the sign bit index (Chiyuan Huang)
- iio: adc: ad7280a: fix ad7280_store_balance_timer() (David Lechner)
- iio: accel: fix ADXL355 startup race condition (Valek Andrej)
- iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792585] {CVE-2025-68330}
- iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling (Olivier Moysan)
- iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet)
- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra)
- iio: humditiy: hdc3020: fix units for thresholds and hysteresis (Dimitri Fedrau)
- iio: humditiy: hdc3020: fix units for temperature and humidity measurement (Dimitri Fedrau)
- iio: buffer: support getting dma channel from the buffer (Nuno Sa)
- iio: buffer-dmaengine: enable .get_dma_dev() (Nuno Sa)
- iio: buffer-dma: support getting the DMA channel (Nuno Sa)
- Revert "perf/x86: Always store regs-&gt;ip in perf_callchain_kernel()" (Jiri Olsa)
- Revert "drm/amd/display: Move setup_stream_attribute" (Alex Deucher)
- spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou)
- spi: nxp-fspi: Propagate fwnode in ACPI case as well (Andy Shevchenko)
- spi: spi-nxp-fspi: Add OCT-DTR mode support (Haibo Chen)
- spi: spi-nxp-fspi: remove the goto in probe (Haibo Chen)
- spi: nxp-fspi: Support per spi-mem operation frequency switches (Miquel Raynal)
- spi: spi-mem: Add a new controller capability (Miquel Raynal)
- spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency (Miquel Raynal)
- spi: spi-mem: Allow specifying the byte order in Octal DTR mode (Tudor Ambarus)
- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (Xu Wang)
- spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA (Francesco Lavra)
- fs/namespace: fix reference leak in grab_requested_mnt_ns (Andrei Vagin) [Orabug: 38773950] {CVE-2025-68300}
- mailbox: pcc: don't zero error register (Jamie Iles)
- mailbox: pcc: Refactor error handling in irq handler into separate function (Sudeep Holla)
- mailbox: mtk-cmdq: Refine DMA address handling for the command buffer (Jason-JH Lin)
- mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang)
- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (Xu Wang)
- iio: st_lsm6dsx: Fixed calibrated timestamp calculation (Mario Tesi)
- net: fec: do not register PPS event for PEROUT (Wei Fang)
- net: fec: do not allow enabling PPS and PEROUT simultaneously (Wei Fang)
- net: fec: do not update PEROUT if it is enabled (Wei Fang)
- net: fec: cancel perout_timer when PEROUT is disabled (Wei Fang)
- net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773728] {CVE-2025-68301}
- eth: fbnic: Fix counter roll-over issue (Mohsin Bashir)
- net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean)
- net: dsa: sja1105: simplify static configuration reload (Russell King)
- net: wwan: mhi: Keep modem name match with Foxconn T99W640 (Slark Xiao)
- drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (Alex Deucher)
- net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev)
- team: Move team device type change at the end of team_port_add (Nikola Z. Ivanov) [Orabug: 38796270] {CVE-2025-68340}
- net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino)
- drm/xe: Fix conversion from clock ticks to milliseconds (Harish Chegondi)
- net: lan966x: Fix the initialization of taprio (Horatiu Vultur)
- net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng)
- platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter)
- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (Daniel Golle)
- veth: reduce XDP no_direct return section to fix race (Jesper Dangaard Brouer) [Orabug: 38796276] {CVE-2025-68341}
- veth: more robust handing of race to avoid txq getting stuck (Jesper Dangaard Brouer)
- veth: prevent NULL pointer dereference in veth_xdp_rcv (Jesper Dangaard Brouer)
- veth: apply qdisc backpressure on full ptr_ring to reduce TX drops (Jesper Dangaard Brouer)
- net: sched: generalize check for no-queue qdisc on TX queue (Jesper Dangaard Brouer)
- Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz)
- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (Edward Adam Davis) [Orabug: 38773949] {CVE-2025-68305}
- Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP (Luiz Augusto von Dentz)
- Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface (Chris Lu) [Orabug: 38773748] {CVE-2025-68306}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data (Marc Kleine-Budde) [Orabug: 38796278] {CVE-2025-68342}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header (Marc Kleine-Budde) [Orabug: 38796285] {CVE-2025-68343}
- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (Marc Kleine-Budde) [Orabug: 38773751] {CVE-2025-68307}
- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [Orabug: 38773759] {CVE-2025-68308}
- LTS version: v6.12.60 (Jack Vogel)
- Revert "gpio: swnode: don't use the swnode's name as the key for GPIO lookup" (Charles Keepax)
- drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched (Fangzhi Zuo)
- drm/amd/display: Insert dccg log for easy debug (Charlene Liu)
- drm/amd/display: disable DPP RCG before DPP CLK enable (Charlene Liu)
- drm/amd/display: avoid reset DTBCLK at clock init (Charlene Liu)
- xfs: fix out of bounds memory read error in symlink repair (Darrick J. Wong) [Orabug: 38730602] {CVE-2025-40246}
- xfs: Replace strncpy with memcpy (Marcelo Moreira)
- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730655] {CVE-2025-40257}
- drm/i915/dp_mst: Disable Panel Replay (Imre Deak)
- maple_tree: fix tracepoint string pointers (Martin Kaiser)
- tty/vt: fix up incorrect backport to stable releases (Jari Ruusu)
- smb: client: fix incomplete backport in cfids_invalidation_worker() (Henrique Carvalho)
- drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (Samuel Zhang) [Orabug: 38773445] {CVE-2025-68230}
- tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun)
- net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
- ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe)
- s390/mm: Fix __ptep_rdp() inline assembly (Heiko Carstens)
- drm/xe: Prevent BIT() overflow when handling invalid prefetch region (Shuicheng Lin)
- Revert "RDMA/irdma: Update Kconfig" (Guan Wentao)
- KVM: arm64: Make all 32bit ID registers fully writable (Marc Zyngier)
- ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai)
- kconfig/nconf: Initialize the default locale at startup (Jakub Horký)
- kconfig/mconf: Initialize the default locale at startup (Jakub Horký)
- net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit)
- blk-crypto: use BLK_STS_INVAL for alignment errors (Carlos Llamas)
- net: tls: Change async resync helpers argument (Shahar Shitrit)
- selftests: net: use BASH for bareudp testing (Po-Hsu Lin)
- x86/microcode/AMD: Limit Entrysign signature checking to known generations (Borislav Petkov)
- scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773425] {CVE-2025-68224}
- cifs: fix typo in enable_gcm_256 module parameter (Steve French)
- bcma: don't register devices disabled in OF (Rafał Miłecki)
- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730610] {CVE-2025-40248}
- cifs: fix memory leak in smb3_fs_context_parse_param error path (Shaurya Rane) [Orabug: 38773403] {CVE-2025-68219}
- LoongArch: Use UAPI types in ptrace UAPI header (Thomas Weißschuh)
- af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic(). (Kuniyuki Iwashima)
- af_unix: Cache state-&gt;msg in unix_stream_read_generic(). (Kuniyuki Iwashima)
- devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (Shay Drory) [Orabug: 38730623] {CVE-2025-40251}
- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (Jared Kangas)
- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (Jared Kangas)
- ice: fix PTP cleanup on driver removal in error path (Grzegorz Nitka) [Orabug: 38773389] {CVE-2025-68215}
- idpf: fix possible vport_config NULL pointer deref in remove (Emil Tantilov) [Orabug: 38773956] {CVE-2025-68213}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730628] {CVE-2025-40252}
- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang)
- selftests: net: lib: Do not overwrite error messages (Ido Schimmel)
- s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
- nvme-multipath: fix lockdep WARN due to partition scan work (Shin'Ichiro Kawasaki) [Orabug: 38773400] {CVE-2025-68218}
- tools: riscv: Fixed misalignment of CSR related definitions (Chen Pei)
- net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730647] {CVE-2025-40254}
- net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() (Pavel Zhigulin)
- net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin)
- drm/tegra: Add call to put_pid() (Prateek Agarwal) [Orabug: 38773463] {CVE-2025-68233}
- mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
- platform/x86: msi-wmi-platform: Fix typo in WMI GUID (Armin Wolf)
- platform/x86: msi-wmi-platform: Only load on MSI devices (Armin Wolf)
- pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() (Xu Wang)
- xfrm: Prevent locally generated packets from direct output in tunnel mode (Jianbo Liu)
- xfrm: Determine inner GSO type from packet inner protocol (Jianbo Liu)
- pinctrl: realtek: Select REGMAP_MMIO for RTD driver (Yu-Chun Lin)
- xfrm: set err and extack on failure to create pcpu SA (Sabrina Dubroca)
- xfrm: drop SA reference in xfrm_state_update if dir doesn't match (Sabrina Dubroca)
- drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 (Ivan Lipski)
- drm/amd/display: Fix pbn to kbps Conversion (Fangzhi Zuo)
- drm/amd/display: Move sleep into each retry for retrieve_link_cap() (Mario Limonciello)
- drm/amd/display: Increase DPCD read retries (Mario Limonciello)
- drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (Yifan Zha)
- drm/amd: Skip power ungate during suspend for VPE (Mario Limonciello)
- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (Robert Mcclinton) [Orabug: 38773418] {CVE-2025-68223}
- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke)
- mptcp: do not fallback when OoO is present (Paolo Abeni)
- mptcp: decouple mptcp fastclose from tcp close (Paolo Abeni)
- mptcp: avoid unneeded subflow-level drops (Paolo Abeni)
- selftests: mptcp: join: userspace: longer timeout (Matthieu Baerts)
- selftests: mptcp: join: endpoints: longer timeout (Matthieu Baerts)
- mptcp: fix premature close in case of fallback (Paolo Abeni)
- mptcp: fix duplicate reset on fastclose (Paolo Abeni)
- mptcp: fix ack generation for fallback msk (Paolo Abeni)
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730658] {CVE-2025-40258}
- LoongArch: Don't panic if no valid cache info for PCI (Huacai Chen)
- dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski)
- MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
- scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773439] {CVE-2025-68229}
- scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730661] {CVE-2025-40259}
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730672] {CVE-2025-40261}
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne)
- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (Nam Cao) [Orabug: 38773467] {CVE-2025-68235}
- mm/mempool: fix poisoning order&gt;0 pages with HIGHMEM (Vlastimil Babka) [Orabug: 38773453] {CVE-2025-68231}
- Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
- Input: imx_sc_key - fix memory corruption on unload (Dan Carpenter)
- Input: goodix - add support for ACPI ID GDIX1003 (Hans de Goede)
- Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730679] {CVE-2025-40263}
- Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" (Diogo Ivo)
- net: dsa: microchip: lan937x: Fix RGMII delay tuning (Oleksij Rempel)
- be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730688] {CVE-2025-40264}
- ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() (Yihang Li)
- smb: client: introduce close_cached_dir_locked() (Henrique Carvalho)
- ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
- mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773434] {CVE-2025-68227}
- mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen)
- exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang)
- shmem: fix tmpfs reconfiguration (remount) when noswap is set (Mike Yuan)
- isofs: check the return value of sb_min_blocksize() in isofs_fill_super (Yongpeng Yang)
- mtdchar: fix integer overflow in read/write ioctls (Dan Carpenter) [Orabug: 38773476] {CVE-2025-68237}
- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara)
- arm64: dts: rockchip: disable HS400 on RK3588 Tiger (Quentin Schulz)
- arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1 (Quentin Schulz)
- arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5 (Mykola Kvach)
- arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2 (Diederik de Haas)
- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
- HID: amd_sfh: Stop sensor before starting (Mario Limonciello)
- timers: Fix NULL function pointer race in timer_shutdown_sync() (Yipeng Zou) [Orabug: 38773387] {CVE-2025-68214}
- KVM: arm64: Check the untrusted offset in FF-A memory share (Sebastian Ene) [Orabug: 38730696] {CVE-2025-40266}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.2.el10uek]" date="1766491200">- LTS version: v6.12.63 (Jack Vogel)
- ASoC: codecs: nau8325: Silence uninitialized variables warnings (Krzysztof Kozlowski)
- ALSA: wavefront: Fix integer overflow in sample size validation (Junrui Luo)
- ALSA: dice: fix buffer overflow in detect_stream_formats() (Junrui Luo)
- usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required (Sven Peter)
- usb: phy: Initialize struct usb_phy list_head (Diogo Ivo)
- usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (Haotien Hsu)
- tcp_metrics: use dst_dev_net_rcu() (Eric Dumazet) [Orabug: 38592188] {CVE-2025-40075}
- net: dst: introduce dst-&gt;dev_rcu (Eric Dumazet)
- net: lan743x: Allocate rings outside ZONE_DMA (Thangaraj Samynathan)
- LoongArch: Add machine_kexec_mask_interrupts() implementation (Huacai Chen)
- ocfs2: fix memory leak in ocfs2_merge_rec_left() (Dmitry Antipov)
- irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (Dan Carpenter)
- scsi: imm: Fix use-after-free bug caused by unfinished delayed work (Duoming Zhou) [Orabug: 38783113] {CVE-2025-68324}
- efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs (Mauro Carvalho Chehab)
- efi/cper: Adjust infopfx size to accept an extra space (Mauro Carvalho Chehab)
- efi/cper: Add a new helper function to print bitmasks (Mauro Carvalho Chehab)
- dm log-writes: Add missing set_freezable() for freezable kthread (Xu Wang)
- dm-raid: fix possible NULL dereference with undefined raid type (Alexey Simakov)
- block: return unsigned int from queue_dma_alignment (Christoph Hellwig)
- block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set-&gt;tag_list_lock (Mohamed Khalfella) [Orabug: 38818209] {CVE-2025-68756}
- ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() (Pangliyuan)
- ALSA: firewire-motu: add bounds check in put_user loop for DSP events (Junrui Luo)
- rtc: gamecube: Check the return value of ioremap() (Xu Wang)
- drm/amdkfd: Use huge page size to check split svm range alignment (Xiaogang Chen)
- ALSA: uapi: Fix typo in asound.h comment (Andres J Rosa)
- docs: hwmon: fix link to g762 devicetree binding (Kathara Sasikumar)
- cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 (David Howells)
- drm/nouveau: refactor deprecated strcpy (Madhur Kumar)
- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (Junrui Luo)
- regulator: fixed: Rely on the core freeing the enable GPIO (Mark Brown)
- drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() (Dan Carpenter)
- nvme-auth: use kvfree() for memory allocated with kvcalloc() (Israel Rukshin)
- block: fix memory leak in __blkdev_issue_zero_pages (Shaurya Rane) [Orabug: 38798772] {CVE-2025-68348}
- block: fix comment for op_is_zone_mgmt() to include RESET_ALL (Shechenglong)
- blk-mq: Abort suspend when wakeup events are pending (Cong Zhang)
- ASoC: ak5558: Disable regulator when error happens (Shengjiu Wang)
- ASoC: ak4458: Disable regulator when error happens (Shengjiu Wang)
- ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (Xu Wang)
- platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (Anton Khirnov)
- fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() (Armin Wolf)
- NFS: Fix inheritance of the block sizes when automounting (Trond Myklebust)
- Expand the type of nfs_fattr-&gt;valid (Trond Myklebust)
- NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (Trond Myklebust) [Orabug: 38818236] {CVE-2025-68764}
- Revert "nfs: ignore SB_RDONLY when mounting nfs" (Trond Myklebust)
- Revert "nfs: clear SB_RDONLY before getting superblock" (Trond Myklebust)
- Revert "nfs: ignore SB_RDONLY when remounting nfs" (Trond Myklebust)
- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (Jonathan Curley) [Orabug: 38798774] {CVE-2025-68349}
- NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state (Trond Myklebust)
- nfs/vfs: discard d_exact_alias() (Neil Brown)
- NFS: Initialise verifiers for visible dentries in nfs_atomic_open() (Trond Myklebust)
- NFS: Initialise verifiers for visible dentries in readdir and lookup (Trond Myklebust)
- fs/nls: Fix utf16 to utf8 conversion (Armin Wolf)
- NFS: Avoid changing nlink when file removes and attribute updates race (Trond Myklebust)
- f2fs: maintain one time GC mode is enabled during whole zoned GC cycle (Daeho Jeong)
- f2fs: add gc_boost_gc_greedy sysfs node (Daeho Jeong)
- f2fs: add gc_boost_gc_multiple sysfs node (Daeho Jeong)
- f2fs: introduce reserved_pin_section sysfs entry (Chao Yu)
- f2fs: sysfs: add encoding_flags entry (Chao Yu)
- f2fs: add carve_out sysfs node (Daeho Jeong)
- f2fs: fix to avoid running out of free segments (Chao Yu)
- f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages (Jaegeuk Kim)
- f2fs: keep POSIX_FADV_NOREUSE ranges (Jaegeuk Kim)
- platform/x86:intel/pmc: Update Arrow Lake telemetry GUID (Xi Pardee)
- sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out (Xupengbo)
- 9p: fix cache/debug options printing in v9fs_show_options (Eric Sandeen)
- fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (Abdun Nihaal)
- pinctrl: single: Fix incorrect type for error return variable (Xu Wang)
- perf hist: In init, ensure mem_info is put on error paths (Ian Rogers)
- perf tools: Fix split kallsyms DSO counting (Namhyung Kim)
- perf tools: Mark split kallsyms DSOs as loaded (Namhyung Kim)
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei) [Orabug: 38783136] {CVE-2025-68325}
- net: dsa: xrs700x: reject unsupported HSR configurations (Vladimir Oltean)
- net: hsr: create an API to get hsr port type (Xiaoliang Yang)
- net: hsr: Create and export hsr_get_port_ndev() (Md Danish Anwar)
- net: hsr: remove synchronize_rcu() from hsr_add_port() (Eric Dumazet)
- net: hsr: remove one synchronize_rcu() from hsr_del_port() (Eric Dumazet)
- clk: keystone: fix compile testing (Johan Hovold)
- md/raid5: fix IO hang when array is broken with IO inflight (Yu Kuai)
- remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs (Alexandru Gagniuc)
- mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (Ivan Stepchenko)
- selftests: bonding: add delay before each xvlan_over_bond connectivity check (Hangbin Liu)
- selftests: bonding: add ipvlan over bond testing (Etienne Champetier)
- net: phy: aquantia: check for NVMEM deferral (Robert Marko)
- vfio/pci: Use RCU for error/request triggers to avoid circular locking (Alex Williamson)
- spi: ch341: fix out-of-bounds memory access in ch341_transfer_one (Tianchu Chen)
- mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (Xu Wang)
- net: stmmac: fix rx limit check in stmmac_rx_zc() (Alexey Kodanev)
- netfilter: nft_connlimit: update the count if add was skipped (Fernando Fernandez Mancera)
- netfilter: nf_conncount: rework API to use sk_buff directly (Fernando Fernandez Mancera)
- netfilter: flowtable: check for maximum number of encapsulations in bridge vlan (Pablo Neira Ayuso)
- Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" (Ilias Stamatis)
- resource: introduce is_type_match() helper and use it (Andy Shevchenko)
- resource: replace open coded resource_intersection() (Andy Shevchenko)
- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (Sparkhuang) [Orabug: 38798786] {CVE-2025-68354}
- ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND (Mikhail Kshevetskiy)
- ASoC: Intel: catpt: Fix error path in hw_params() (Cezary Rojewski)
- vdpa/pds: use %pe for ERR_PTR() in event handler registration (Alok Tiwari)
- vhost: Fix kthread worker cgroup failure handling (Mike Christie)
- vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues (Alok Tiwari)
- virtio: fix virtqueue_set_affinity() docs (Michael S. Tsirkin)
- virtio: fix grammar in virtio_queue_info docs (Michael S. Tsirkin)
- virtio: fix whitespace in virtio_config_ops (Michael S. Tsirkin)
- virtio: fix typo in virtio_device_ready() comment (Michael S. Tsirkin)
- virtio_vdpa: fix misleading return in void function (Alok Tiwari)
- of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node (Guenter Roeck)
- ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation (Yongjian Sun)
- ublk: prevent invalid access with DEBUG (Kevin Brodsky)
- ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (René Rebe)
- hwmon: sy7636a: Fix regulator_enable resource leak on error path (Xu Wang)
- drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (Dan Carpenter)
- greybus: gb-beagleplay: Fix timeout handling in bootloader functions (Xu Wang)
- firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER (Alexandre Courbot)
- ASoC: fsl_xcvr: clear the channel status control memory (Shengjiu Wang)
- gfs2: Prevent recursive memory reclaim (Andreas Gruenbacher) [Orabug: 38798793] {CVE-2025-68356}
- ASoC: nau8325: add missing build config (Jaroslav Kysela)
- ASoC: nau8325: use simple i2c probe function (Jaroslav Kysela)
- drm/panthor: Avoid adding of kernel BOs to extobj list (Akash Goel)
- RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY (Jacob Moroni)
- RDMA/irdma: Fix data race in irdma_free_pble (Krzysztof Czurylo)
- RDMA/irdma: Fix data race in irdma_sc_ccq_arm (Krzysztof Czurylo)
- iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal (Stephan Gerhold)
- backlight: lp855x: Fix lp855x.h kernel-doc warnings (Randy Dunlap)
- backlight: led-bl: Add devlink to supplier LEDs (Luca Ceresoli)
- wifi: ieee80211: correct FILS status codes (Ria Thomas)
- iomap: always run error completions in user context (Christoph Hellwig)
- iomap: factor out a iomap_dio_done helper (Christoph Hellwig)
- um: Don't rename vmap to kernel_vmap (David Gow)
- drm/nouveau: restrict the flush page to a 32-bit address (Timur Tabi)
- PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (Shawn Lin)
- btrfs: fix leaf leak in an error path in btrfs_del_items() (Filipe Manana)
- iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables (Ryan Huang)
- staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (Jianglei Nie)
- firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (Dinh Nguyen)
- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (Zilin Guan)
- ASoC: tas2781: correct the wrong period (Shenghao Ding)
- RDMA/bnxt_re: Pass correct flag for dma mr creation (Selvin Xavier)
- RDMA/bnxt_re: Fix the inline size for GenP7 devices (Selvin Xavier)
- erofs: limit the level of fs stacking for file-backed mounts (Gao Xiang)
- RISC-V: KVM: Fix guest page fault within HLV* instructions (Fangyu Yu)
- crypto: ccree - Correctly handle return of sg_nents_for_len (Xu Wang)
- crypto: starfive - Correctly handle return of sg_nents_for_len (Xu Wang)
- selftests/bpf: Improve reliability of test_perf_branches_no_hw() (Matt Bobrowski)
- selftests/bpf: skip test_perf_branches_hw() on unsupported platforms (Matt Bobrowski)
- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon)
- usb: dwc2: fix hang during suspend if set as peripheral (Jisheng Zhang)
- usb: dwc2: fix hang during shutdown if set as peripheral (Jisheng Zhang)
- usb: dwc2: disable platform lowlevel hw resources during shutdown (Jisheng Zhang)
- usb: chaoskey: fix locking for O_NONBLOCK (Oliver Neukum)
- ima: Handle error code returned by ima_filter_rule_match() (Zhao Yipeng) [Orabug: 38798921] {CVE-2025-68740}
- RAS: Report all ARM processor CPER information to userspace (Jason Tian)
- wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (Seungjin Bae) [Orabug: 38798814] {CVE-2025-68362}
- cpuset: Treat cpusets in attaching as populated (Chen Ridong)
- net: phy: adin1100: Fix software power-down ready condition (Alexander Dahl)
- phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth (Cristian Ciocaltea)
- phy: freescale: Initialize priv-&gt;lock (Xiaolei Wang)
- phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (Christophe Jaillet)
- leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM (Fenglin Wu)
- mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- wifi: mac80211: fix CMAC functions not handling errors (Chien Wong)
- iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb (Aashish Sharma)
- scsi: qla2xxx: Fix improper freeing of purex item (Zilin Guan) [Orabug: 38798928] {CVE-2025-68741}
- pwm: bcm2835: Make sure the channel is enabled after pwm_request() (Uwe Kleine-König)
- perf arm_spe: Fix memset subclass in operation (Leo Yan)
- perf arm-spe: Extend branch operations (Leo Yan)
- ipv6: clear RA flags when adding a static route (Fernando Fernandez Mancera)
- drm/msm/a6xx: Improve MX rail fallback in RPMH vote init (Akhil P Oommen)
- drm/msm/a6xx: Fix the gemnoc workaround (Akhil P Oommen)
- drm/msm/a6xx: Flush LRZ cache before PT switch (Akhil P Oommen)
- drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (Jay Liu)
- fs/ntfs3: Prevent memory leaks in add sub record (Edward Adam Davis)
- fs/ntfs3: out1 also needs to put mi (Edward Adam Davis)
- powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format (Ritesh Harjani)
- powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit (Ritesh Harjani)
- bpf: Fix invalid prog-&gt;stats access when update_effective_progs fails (Pu Lehui) [Orabug: 38798931] {CVE-2025-68742}
- wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (Abdun Nihaal) [Orabug: 38818221] {CVE-2025-68759}
- drm/msm/a2xx: stop over-complaining about the legacy firmware (Dmitry Baryshkov)
- block/blk-throttle: Fix throttle slice time for SSDs (Guenter Roeck)
- NFSD/blocklayout: Fix minlength check in proc_layoutget (Sergey Bashirov)
- tracefs: fix a leak in eventfs_create_events_dir() (Al Viro)
- watchdog: starfive: Fix resource leak in probe error path (Xu Wang)
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (Xu Wang)
- bpf: Check skb-&gt;transport_header is set in bpf_skb_check_mtu (Martin Kafai Lau) [Orabug: 38798820] {CVE-2025-68363}
- selftests/bpf: Fix failure paths in send_signal test (Alexei Starovoitov)
- bpf: Handle return value of ftrace_set_filter_ip in register_fentry (Menglong Dong)
- ps3disk: use memcpy_{from,to}_bvec index (René Rebe)
- drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype (Dmitry Baryshkov)
- crypto: iaa - Fix incorrect return value in save_iaa_wq() (Zilin Guan)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C (Fukaumi Naoki)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A (Fukaumi Naoki)
- arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A (Fukaumi Naoki)
- PCI: keystone: Exit ks_pcie_probe() for invalid mode (Siddharth Vadapalli)
- bpf: Free special fields when update [lru_,]percpu_hash maps (Leon Hwang) [Orabug: 38798936] {CVE-2025-68744}
- leds: netxbig: Fix GPIO descriptor leak in error paths (Xu Wang)
- scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls (Xu Wang)
- ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (Xu Wang)
- ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() (Dmitry Antipov) [Orabug: 38798823] {CVE-2025-68364}
- lib/vsprintf: Check pointer before dereferencing in time_and_date() (Andy Shevchenko)
- clk: renesas: r9a06g032: Fix memory leak in error path (Xu Wang)
- coresight: etm4x: Add context synchronization before enabling trace (Leo Yan)
- coresight: etm4x: Extract the trace unit controlling (Leo Yan)
- coresight: etm4x: Correct polling IDLE bit (Leo Yan)
- coresight: Change device mode to atomic type (Leo Yan)
- nbd: defer config unlock in nbd_genl_connect (Zheng Qixing) [Orabug: 38798832] {CVE-2025-68366}
- wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (Abdun Nihaal)
- macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (Long Li) [Orabug: 38798837] {CVE-2025-68367}
- powerpc/32: Fix unpaired stwcx. on interrupt exit (Christophe Leroy)
- powerpc/kdump: Fix size calculation for hot-removed memory ranges (Sourabh Jain)
- cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs (Gautham R. Shenoy)
- scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() (Bean Huo)
- drm/panthor: Fix potential memleak of vma structure (Akash Goel)
- ntfs3: init run lock for extend inode (Edward Adam Davis)
- ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties (Jihed Chaibi)
- RDMA/rtrs: server: Fix error handling in get_or_create_srv (Ma Ke)
- dt-bindings: PCI: amlogic: Fix the register name of the DBI region (Manivannan Sadhasivam)
- scsi: smartpqi: Fix device resources accessed after device removal (Mike Mcgowen) [Orabug: 38798847] {CVE-2025-68371}
- scsi: stex: Fix reboot_notifier leak in probe error path (Xu Wang)
- nbd: defer config put in recv_work (Zheng Qixing) [Orabug: 38798850] {CVE-2025-68372}
- md: fix rcu protection in md_wakeup_thread (Yun Zhou) [Orabug: 38798857] {CVE-2025-68374}
- regulator: core: disable supply if enabling main regulator fails (Gabor Juhos)
- perf/x86/intel: Correct large PEBS flag check (Dapeng Mi)
- ext4: correct the checking of quota files before moving extents (Zhang Yi)
- mfd: da9055: Fix missing regmap_del_irq_chip() in error path (Xu Wang)
- locktorture: Fix memory leak in param_set_cpumask() (Wang Liang)
- efi/libstub: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- x86/boot: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels (Yegor Yefremov)
- libbpf: Fix parsing of multi-split BTF (Alan Maguire)
- spi: tegra210-quad: Fix timeout handling (Vishwaroop A) [Orabug: 38798943] {CVE-2025-68746}
- drm/panthor: Fix UAF on kernel BO VA nodes (Boris Brezillon)
- drm/panthor: Fix race with suspend during unplug (Ketil Johnsen)
- drm/panthor: Fix UAF race between device unplug and FW event processing (Ketil Johnsen)
- drm/panthor: Fix group_free_queue() for partially initialized queues (Boris Brezillon)
- drm/panthor: Handle errors returned by drm_sched_entity_init() (Boris Brezillon)
- fs/9p: Don't open remote file with APPEND mode when writeback cache is used (Tingmao Wang)
- scsi: target: Do not write NUL characters into ASCII configfs output (Bart Van Assche)
- power: supply: apm_power: only unset own apm_get_power_status (Ahelenia Ziemiańska)
- power: supply: wm831x: Check wm831x_set_bits() return value (Ivan Abramov)
- power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (Murad Masimov)
- power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (Ivan Abramov)
- power: supply: max17040: Check iio_read_channel_processed() return code (Ivan Abramov)
- power: supply: cw2015: Check devm_delayed_work_autocancel() return code (Ivan Abramov)
- power: supply: rt5033_charger: Fix device node reference leaks (Xu Wang)
- perf record: skip synthesize event when open evsel failed (Shuai Xue)
- perf lock contention: Load kernel map before lookup (Namhyung Kim)
- drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() (Geert Uytterhoeven)
- interconnect: debugfs: Fix incorrect error handling for NULL path (Kuan-Wei Chiu)
- arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller (Dmitry Baryshkov)
- interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS (Dmitry Baryshkov)
- wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() (Abdun Nihaal)
- i3c: master: svc: Prevent incomplete IBI transaction (Stanley Chu)
- i3c: fix refcount inconsistency in i3c_master_register (Frank Li)
- pinctrl: stm32: fix hwspinlock resource leak in probe function (Xu Wang)
- soc: qcom: smem: fix hwspinlock resource leak in probe error paths (Xu Wang)
- tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set (Benjamin Berg)
- x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() (Tengda Wu)
- task_work: Fix NMI race condition (Peter Zijlstra)
- perf/x86/intel/cstate: Remove PC3 support from LunarLake (Zhang Rui)
- bpf: Fix stackmap overflow check in __bpf_get_stackid() (Arnaud Lecomte) [Orabug: 38798864] {CVE-2025-68378}
- bpf: Refactor stack map trace depth calculation into helper function (Arnaud Lecomte)
- perf: Remove get_perf_callchain() init_nr argument (Josh Poimboeuf)
- mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (Xu Wang)
- mtd: nand: relax ECC parameter validation check (Aryan Srivastava)
- Revert "mtd: rawnand: marvell: fix layouts" (Aryan Srivastava)
- ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties (Wolfram Sang)
- ARM: dts: renesas: gose: Remove superfluous port property (Wolfram Sang)
- RDMA/rxe: Fix null deref on srq-&gt;rq.queue after resize failure (Zhu Yanjun) [Orabug: 38798867] {CVE-2025-68379}
- sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Kuniyuki Iwashima)
- phy: mscc: Fix PTP for VSC8574 and VSC8572 (Horatiu Vultur)
- arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory (Alexander Martinz)
- arm64: dts: qcom: sm8650: set ufs as dma coherent (Neil Armstrong)
- arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider (Gergo Koteles)
- arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller (Krishna Kurapati)
- arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller (Krishna Kurapati)
- firmware: imx: scu-irq: fix OF node leak in (Peng Fan)
- arm64: dts: ti: k3-am62p: Fix memory ranges for GPU (Randolph Sapp)
- s390/ap: Don't leak debug feature files if AP instructions are not available (Heiko Carstens)
- s390/smp: Fix fallback CPU detection (Heiko Carstens)
- wifi: ath11k: fix peer HE MCS assignment (Baochen Qiang) [Orabug: 38798872] {CVE-2025-68380}
- wifi: ath11k: fix VHT MCS assignment (Baochen Qiang)
- crypto: hisilicon/qm - restore original qos values (Nieweiqiang)
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (Thorsten Blum) [Orabug: 38798874] {CVE-2025-68724}
- soc: qcom: gsbi: fix double disable caused by devm (Xu Wang)
- soc: Switch back to struct platform_driver::remove() (Uwe Kleine-König)
- clk: qcom: camcc-sm7150: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (Li Qiang)
- PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (Geert Uytterhoeven)
- arm64: dts: exynos: gs101: fix sysreg_apm reg property (Peter Griffin)
- perf annotate: Check return value of evsel__get_arch() properly (Tianyou Li)
- arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 (Tim Harvey)
- arm64: dts: imx8mp-venice-gw702x: remove off-board uart (Tim Harvey)
- arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl (Tim Harvey)
- arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props (Tim Harvey)
- block/mq-deadline: Switch back to a single dispatch list (Bart Van Assche)
- block/mq-deadline: Introduce dd_start_request() (Bart Van Assche)
- firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc (Randy Dunlap)
- iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (Francesco Lavra)
- inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() (Luoxuanqiang)
- inet: Avoid ehash lookup race in inet_ehash_insert() (Luoxuanqiang)
- rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() (Luoxuanqiang)
- clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets (Stephan Gerhold)
- ntfs3: Fix uninit buffer allocated by __getname() (Sidharth Seela)
- ntfs3: fix uninit memory after failed mi_read in mi_format_new (Raphael Pinsonneault-Thibeault)
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Herbert Xu)
- irqchip/qcom-irq-combiner: Fix section mismatch (Johan Hovold)
- irqchip/starfive-jh8100: Fix section mismatch (Johan Hovold)
- irqchip/renesas-rzg2l: Fix section mismatch (Johan Hovold)
- irqchip/imx-mu-msi: Fix section mismatch (Johan Hovold)
- irqchip/irq-brcmstb-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7120-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7038-l1: Fix section mismatch (Johan Hovold)
- sched/fair: Forfeit vruntime on yield (Fernand Sieber)
- wifi: ath11k: restore register window after global reset (Baochen Qiang)
- wifi: ath10k: move recovery check logic into a new work (Kang Yang)
- wifi: ath10k: Add missing include of export.h (Jeff Johnson)
- wifi: ath10k: Avoid vdev delete timeout when firmware is already down (Loic Poulain)
- objtool: Fix weak symbol detection (Josh Poimboeuf)
- objtool: Fix standalone --hacks=jump_label (Dylan Hatch)
- HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (Mavroudis Chatzilazaridis)
- drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() (Cyrille Pitchen)
- clk: renesas: cpg-mssr: Read back reset registers to assure values latched (Marek Vasut)
- clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register (Thierry Bultel)
- clk: renesas: Use str_on_off() helper (Geert Uytterhoeven)
- clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (Marek Vasut)
- pinctrl: renesas: rzg2l: Fix PMC restore (Biju Das)
- USB: Fix descriptor count when handling invalid MBIM extended descriptor (Seungjin Bae)
- drm/vgem-fence: Fix potential deadlock on release (Janusz Krzysztofik) [Orabug: 38818211] {CVE-2025-68757}
- accel/ivpu: Fix DCT active percent format (Karol Wachowski)
- accel/ivpu: Make function parameter names consistent (Jacek Lawrynowicz)
- drm/panel: visionox-rm69299: Don't clear all mode flags (Guido Günther)
- accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail (Karol Wachowski)
- accel/ivpu: Prevent runtime suspend during context abort work (Andrzej Kacprowski)
- gpu: host1x: Fix race in syncpt alloc/free (Mainak Sen) [Orabug: 38798898] {CVE-2025-68732}
- smack: fix bug: setting task label silently ignores input garbage (Konstantin Andreev)
- smack: fix bug: unprivileged task can create labels (Konstantin Andreev)
- smack: fix bug: invalid label of unix socket file (Konstantin Andreev)
- smack: always "instantiate" inode in smack_inode_init_security() (Konstantin Andreev)
- smack: deduplicate xattr setting in smack_inode_init_security() (Konstantin Andreev)
- smack: fix bug: SMACK64TRANSMUTE set on non-directory (Konstantin Andreev)
- smack: deduplicate "does access rule request transmutation" (Konstantin Andreev)
- net/mlx5e: Set default burst period for TX and RX reporters (Shahar Shitrit) [Orabug: 38636804]
- devlink: Make health reporter burst period configurable (Shahar Shitrit) [Orabug: 38636804]
- devlink: Introduce burst period for health reporter (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move health reporter recovery abort logic to a separate function (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move graceful period parameter to reporter ops (Shahar Shitrit) [Orabug: 38636804]
- devlink: use devlink_nl_put_u64() helper (Przemek Kitszel) [Orabug: 38636804]
- devlink: introduce devlink_nl_put_u64() (Przemek Kitszel) [Orabug: 38636804]
- Revert "net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery" (Qing Huang) [Orabug: 38636804]
- net/rds: improve conn destroy printk message (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: expand kref coverage to rds_notifier-&gt;n_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: rds_sendmsg must use rs_conn only when not being destroyed (Sharath Srinivasan) [Orabug: 38728742]
- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang) [Orabug: 38766139]
- mm: list_lru: avoid using NULL list_lru_one. (Imran Khan) [Orabug: 38787957]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg)
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa)
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn)
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe)
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping)
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen)
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan)
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo) [Orabug: 38847806] {CVE-2025-68789}
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera)
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38649136]  {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.1.el10uek]" date="1769688000">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang)  [Orabug: 38899652]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.2.el10uek]" date="1770897600">- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan)  [Orabug: 38937451]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.3.el10uek]" date="1771329600">- net/rds: Fix issue with a revert in rds_send_queue_rm (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
</package>
<package pkgid="4d05801c3e5fed9d5d3fe70304d146fd9c2255a7" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="109.67.6.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg) [Orabug: 38887626] {CVE-2025-71156}
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa) [Orabug: 38887628] {CVE-2025-71157}
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn) [Orabug: 38887618] {CVE-2025-71154}
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe) [Orabug: 38887603] {CVE-2025-71149}
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping) [Orabug: 38887600] {CVE-2025-71148}
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen) [Orabug: 38887596] {CVE-2025-71147}
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan) [Orabug: 38887608] {CVE-2025-71151}
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo)
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera) [Orabug: 38887785] {CVE-2025-71146}
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.6.el10uek]" date="1772884800">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong)  [Orabug: 39027305]</changelog>
</package>
<package pkgid="55a169395272f9b9def0bb14ba891ba6b486ad53" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315]</changelog>
</package>
<package pkgid="cf4f0e4cac78d75c09ce6e00bded1913e86d0927" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-200.74.27.2.el10uek]" date="1775649600">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39186444]  {CVE-2025-40135} 
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39181102]  {CVE-2026-23231} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39181101]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="00b40529d48b6660c0d41e4343c79b6d8df0fbd6" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]  
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]  
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
</package>
<package pkgid="883bbffce9d21d04998ec2535f01f96963295817" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]  
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]  
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="730ef06de36b3a65ce56c753781a8051c972e3e8" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]  
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]  
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431} 
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]  
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]  
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]  
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
</package>
<package pkgid="dfbbf4b610ff985ca46bc6f325e626029613e860" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-201.74.2.3.el10uek]" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39342689]  {CVE-2026-43500} 
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39342689]  
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39342689]  
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39342689]  
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39342689]  {CVE-2026-43284}</changelog>
</package>
<package pkgid="bff913bfc42d74273447d133a853c900cd0aec39" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck)
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park)
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong)
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck)
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu)
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong)
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N)
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He)
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin)
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian)
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko)
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu)
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N)
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo)
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement)
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K)
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen)
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy)
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle)
- kexec: derive purgatory entry from symbol (Li Chen)
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao)
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez)
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey)
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang)
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev)
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong)
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong)
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson)
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo)
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig)
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav)
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed)
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang)
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao)
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal)
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal)
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li)
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li)
- media: radio-keene: fix memory leak in error path (Shaurya Rane)
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack)
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack)
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack)
- HID: hid-pl: handle probe errors (Oliver Neukum)
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson)
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers)
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han)
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian)
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski)
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu)
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni)
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo)
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi)
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo)
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa)
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen)
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai)
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt)
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov)
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal)
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li)
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni)
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek)
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui)
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith)
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith)
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai)
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan)
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan)
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus)
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook)
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek)
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin)
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu)
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao)
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi)
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen)
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang)
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li)
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab)
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab)
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab)
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab)
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang)
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho)
- gfs2: fiemap page fault fix (Andreas Gruenbacher)
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang)
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn)
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150]
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116]
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972]
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500} 
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]  
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513]  
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]  
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]  
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]  
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284} 
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
</package>
<package pkgid="cfe2d49c3948ab848cee1a9b1cf1af765548e688" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974] {CVE-2026-43129}
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270} 
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278} 
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
</package>
<package pkgid="ecf38b372a5b83f33d828288674c8878daafbb4d" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278}
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-202.76.4.3.el10uek]" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391434]  {CVE-2026-46333}</changelog>
</package>
<package pkgid="bd005b31e3024d055e5338460018792c268c8bb8" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278}
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-202.76.4.3.el10uek]" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391434]  {CVE-2026-46333}</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.4.el10uek]" date="1779364800">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39420559]  {CVE-2026-46300} 
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39420559]</changelog>
</package>
<package pkgid="6bb7e3f1f8f90dfa00d91bf31abe8fbbd7eda39d" name="kernel-uek-debug-devel" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="203.76.7.1.el10uek"/>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) [Orabug: 39227772] {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) [Orabug: 39251164] {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) [Orabug: 39251169] {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) [Orabug: 39262447] {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) [Orabug: 39331678] {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) [Orabug: 39331784] {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) [Orabug: 39300554] {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) [Orabug: 39331889] {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) [Orabug: 39331303] {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) [Orabug: 39331577] {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) [Orabug: 39339241] {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) [Orabug: 39343623] {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) [Orabug: 39331924] {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) [Orabug: 39331696] {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) [Orabug: 39331680] {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) [Orabug: 39331661] {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) [Orabug: 39331512] {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) [Orabug: 39331937] {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) [Orabug: 39331435] {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) [Orabug: 39331422] {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) [Orabug: 39343538] {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) [Orabug: 39331504] {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) [Orabug: 39331827] {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) [Orabug: 39343546] {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) [Orabug: 39331482] {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) [Orabug: 39331693] {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) [Orabug: 39331458] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) [Orabug: 39331580] {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) [Orabug: 39331409] {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) [Orabug: 39331341] {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) [Orabug: 39331444] {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) [Orabug: 39331510] {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) [Orabug: 39331358] {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) [Orabug: 39331954] {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) [Orabug: 39331545] {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) [Orabug: 39331821] {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) [Orabug: 39331705] {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) [Orabug: 39331366] {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) [Orabug: 39331866] {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) [Orabug: 39331752] {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) [Orabug: 39331370] {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) [Orabug: 39331846] {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) [Orabug: 39331389] {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) [Orabug: 39331440] {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) [Orabug: 39343613] {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) [Orabug: 39331353] {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) [Orabug: 39331023] {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) [Orabug: 39331012] {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) [Orabug: 39331761] {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) [Orabug: 39331606] {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) [Orabug: 39331628] {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) [Orabug: 39331331] {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) [Orabug: 39331449] {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) [Orabug: 39331361] {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) [Orabug: 39331875] {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) [Orabug: 39331549] {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) [Orabug: 39331496] {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) [Orabug: 39331383] {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) [Orabug: 39331959] {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) [Orabug: 39343626] {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [Orabug: 39343577] {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) [Orabug: 39331591] {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) [Orabug: 39343531] {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) [Orabug: 39331853] {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) [Orabug: 39331859] {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) [Orabug: 39343609] {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) [Orabug: 39331003] {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) [Orabug: 39343515] {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) [Orabug: 39331318] {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) [Orabug: 39331375] {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) [Orabug: 39343527] {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) [Orabug: 39331585] {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) [Orabug: 39343616] {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) [Orabug: 39331719] {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) [Orabug: 39331807] {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) [Orabug: 39343628] {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) [Orabug: 39331070] {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) [Orabug: 39331308] {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) [Orabug: 39343581] {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) [Orabug: 39331918] {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) [Orabug: 39343603] {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) [Orabug: 39331896] {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) [Orabug: 39331636] {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) [Orabug: 39331947] {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) [Orabug: 39331518] {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) [Orabug: 39331877] {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) [Orabug: 39331789] {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) [Orabug: 39331882] {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) [Orabug: 39331312] {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) [Orabug: 39331077] {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 38649060,39186444,39202432] {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet) [Orabug: 38887740,39181101,39202431] {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera) [Orabug: 39029337,39131054] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe) [Orabug: 39144150,39343763] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao) [Orabug: 38970584,39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A) [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu) [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu) [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu) [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu) [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu) [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski) [Orabug: 39166116]</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.1.el10uek]" date="1776772800">- Revert "EDAC: Octeon: Init SDEI" (Jeremy Tang) [Orabug: 39203407]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.2.el10uek]" date="1777464000">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman) [Orabug: 39276980]
- uek-rpm/config-aarch64: Enable NVIDIA-recommended Vera-Rubin configs (Vijay Kumar) [Orabug: 39157707]
- kselftest/arm64: Add HWCAP test for FEAT_LS64 (Yicong Yang) [Orabug: 39157707]
- arm64: Provide basic EL2 setup for FEAT_{LS64, LS64_V} usage at EL0/1 (Yicong Yang) [Orabug: 39157707]
- perf: arm_spe: Relax period restriction (Leo Yan) [Orabug: 39157707]
- perf/arm_cspmu: Add PMEVFILT2R support (Robin Murphy) [Orabug: 39157707]
- ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional (Lifeng Zheng) [Orabug: 39157707]
- dt-bindings: gpio: Add Tegra256 support (Prathamesh Shete) [Orabug: 39157707]
- perf/arm_cspmu: nvidia: Add revision id matching (Besar Wicaksono) [Orabug: 39157707]
- arm64: Handle BRBE booting requirements (Anshuman Khandual) [Orabug: 39157707]
- arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again (Rob Herring) [Orabug: 39157707]
- arm64/gcs: Provide basic EL2 setup to allow GCS usage at EL0 and EL1 (Mark Brown) [Orabug: 39157707]
- tools headers arm64: Add NVIDIA Olympus part (Besar Wicaksono) [Orabug: 39157707]
- perf arm-spe: Add NVIDIA Olympus to neoverse list (Besar Wicaksono) [Orabug: 39157707]
- perf arm_spe: Add CPU variants supporting common data source packet (Leo Yan) [Orabug: 39157707]
- arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Yicong Yang) [Orabug: 39157707]
- perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Yicong Yang) [Orabug: 39157707]
- perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions (Yicong Yang) [Orabug: 39157707]
- perf/arm_cspmu: nvidia: Add pmevfiltr2 support (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Add pmpidr support (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Move register definitons to header (Robin Murphy) [Orabug: 39157707]
- perf/arm_cspmu: Add callback to reset filter config (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Generalise event filtering (Robin Murphy) [Orabug: 39157707]
- perf: arm_pmuv3: Add support for the Branch Record Buffer Extension (BRBE) (Rob Herring) [Orabug: 39157707]
- arm64/sysreg: Add BRBE registers and fields (Anshuman Khandual) [Orabug: 39157707]
- perf: arm_pmu: Move PMUv3-specific data (Mark Rutland) [Orabug: 39157707]
- perf: apple_m1: Don't disable counter in m1_pmu_enable_event() (Rob Herring) [Orabug: 39157707]
- perf: arm_v7_pmu: Don't disable counter in (armv7|krait_|scorpion_)pmu_enable_event() (Rob Herring) [Orabug: 39157707]
- perf: arm_v7_pmu: Drop obvious comments for enabling/disabling counters and interrupts (Rob Herring) [Orabug: 39157707]
- perf: arm_pmuv3: Don't disable counter in armv8pmu_enable_event() (Mark Rutland) [Orabug: 39157707]
- ACPI: CPPC: Rename EPP constants for clarity (Sumit Gupta) [Orabug: 39157707]
- ACPI: CPPC: Add three functions related to autonomous selection (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel() (Lifeng Zheng) [Orabug: 39157707]
- cpufreq/amd-pstate: Store the boost numerator as highest perf again (Mario Limonciello) [Orabug: 39157707]
- ACPI: CPPC: Refactor register value get and set ABIs (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Add cppc_set_reg_val() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Extract cppc_get_reg_val_in_pcc() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Optimize cppc_get_perf() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu() (Jie Zhan) [Orabug: 39157707]
- ACPI: CPPC: Clean up cppc_perf_caps and cppc_perf_ctrls structs (Sumit Gupta) [Orabug: 39157707]
- cpufreq: CPPC: Add generic helpers for sysfs show/store (Sumit Gupta) [Orabug: 39157707]
- cpufreq: CPPC: Add support for autonomous selection (Lifeng Zheng) [Orabug: 39157707]
- PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (Nirmoy Das) [Orabug: 39157707]
- PCI: Add ASPEED vendor ID to pci_ids.h (Nirmoy Das) [Orabug: 39157707]
- i2c: tegra: Add support for SW mutex register (Kartik) [Orabug: 39157707]
- i2c: tegra: Use internal reset when reset property is not available (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add HS mode support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Update Tegra256 timing parameters (Akhil R) [Orabug: 39157707]
- i2c: tegra: Use separate variables for fast and fastplus (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add Tegra264 support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add Tegra256 support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Do not configure DMA if not supported (Kartik) [Orabug: 39157707]
- gpio: tegra186: Fix GPIO name collisions for Tegra410 (Kartik) [Orabug: 39157707]
- gpio: tegra186: Use generic macro for port definitions (Kartik) [Orabug: 39157707]
- gpio: tegra186: Add support for Tegra410 (Prathamesh Shete) [Orabug: 39157707]
- gpio: tegra186: Add support for Tegra256 (Prathamesh Shete) [Orabug: 39157707]
- arm64: acpi: Enable ACPI CCEL support (Suzuki K Poulose) [Orabug: 39157707]
- arm64: Enable EFI secret area Securityfs support (Suzuki K Poulose) [Orabug: 39157707]
- arm64: realm: ioremap: Allow mapping memory as encrypted (Suzuki K Poulose) [Orabug: 39157707]
- arm64: Document Arm Confidential Compute (Steven Price) [Orabug: 39157707]
- virt: arm-cca-guest: TSM_REPORT support for realms (Sami Mujawar) [Orabug: 39157707]
- arm64: Enable memory encrypt for Realms (Suzuki K Poulose) [Orabug: 39157707]
- arm64: mm: Avoid TLBI when marking pages as valid (Steven Price) [Orabug: 39157707]
- arm64: Enforce bounce buffers for realm DMA (Steven Price) [Orabug: 39157707]
- efi: arm64: Map Device with Prot Shared (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Map unprotected MMIO as decrypted (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Add support for checking whether an MMIO is protected (Suzuki K Poulose) [Orabug: 39157707]
- arm64: realm: Query IPA size from the RMM (Steven Price) [Orabug: 39157707]
- arm64: Detect if in a realm and set RIPAS RAM (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Add RSI definitions (Suzuki K Poulose) [Orabug: 39157707]
- PCI/TPH: Add TPH documentation (Wei Huang) [Orabug: 39157707]
- PCI/TPH: Add Steering Tag support (Wei Huang) [Orabug: 39157707]
- PCI: Add TLP Processing Hints (TPH) support (Wei Huang) [Orabug: 39157707]
- sched: Update rq-&gt;avg_idle when a task is moved to an idle CPU (Shubhang Kaushik) [Orabug: 39214522]
- arm64: mte: Set TCMA1 whenever MTE is present in the kernel (Carl Worth) [Orabug: 39214522]
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov) [Orabug: 39241227,39273721] {CVE-2026-31628}
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp) [Orabug: 39252919]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp) [Orabug: 39259550]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.3.el10uek]" date="1777982400">- sched/deadline: Use revised wakeup rule for dl_server (Peter Zijlstra)
- netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [Orabug: 39339273] {CVE-2026-43084}
- netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -&gt; GFP_KERNEL_ACCOUNT allocation (Scott Mitchell)
- Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt" (Sasha Levin)
- Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads" (Sasha Levin)
- iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() (Zhen Ni) [Orabug: 39145066]
- iommu/amd: Fix header file (Vasant Hegde) [Orabug: 39145066]
- iommu/amd: Preserve default DTE fields when updating Host Page Table Root (Alejandro Jimenez) [Orabug: 39145066]
- iommu/amd: Enable support for up to 2K interrupts per function (Kishon Vijay Abraham I) [Orabug: 39145066]
- iommu/amd: Rename DTE_INTTABLEN* and MAX_IRQS_PER_TABLE macro (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Replace slab cache allocator with page allocator (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Introduce generic function to set multibit feature value (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Remove amd_iommu_apply_erratum_63() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Lock DTE before updating the entry with WRITE_ONCE() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Modify clear_dte_entry() to avoid in-place update (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce helper function get_dte256() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Modify set_dte_entry() to use 256-bit DTE helpers (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce helper function to update 256-bit DTE (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce struct ivhd_dte_flags to store persistent DTE flags (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Misc ACPI IVRS debug info clean up (Suravee Suthikulpanit) [Orabug: 39145066]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39250685,39331108] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [Orabug: 39250685]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug: 39250685,39300909] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250685]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le) [Orabug: 39250685]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug: 39250685,39283866,39291972,39292190] {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250685]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers) [Orabug: 39250685]
- iommu/arm-smmu-v3: Handle zeroed A4-2C HTTU override settings (Joao Martins) [Orabug: 39260974]</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.4.el10uek]" date="1778587200">- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39218893]  {CVE-2025-54518}
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39334587]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39334587]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39334587]
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39334587]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39334587]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39334587]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39334587]  {CVE-2026-43284}
- bcm-hsdk-gpl: Fix build issues for HSDK 6.5.34 (Vijay Kumar)  [Orabug: 39342234]
- bcm-hsdk-gpl: Update BCM HSDK GPL driver to 6.5.34 (Vijay Kumar)  [Orabug: 39342234]
- minke-fan-cpld: Avoid logging 'unknown fan id' when no fan is present (arista-hpandya)  [Orabug: 39335238]
- exadata: tools: perf: update column to comm_nodigit (Stephen Brennan)  [Orabug: 39327035]
- perf report: Add comm_nodigit sort key (Stephen Brennan)  [Orabug: 39327035]
- Revert "tools: perf: add comm_ignore_digit column" (Stephen Brennan)  [Orabug: 39327035]
- octeontx2-af: cn20k: Fix RVU AF interrupt handler (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Move QMEM allocations from GFP_KERNEL to ATOMIC (Sunil Goutham)  [Orabug: 39318904]
- bphy-pf: CNF20Ka: poll MHABs based on cpri_mask instead of fixed count (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: Add devlink param for NIX RQ caching (Nishok A)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix the RVUAF-&gt;PF mbox address (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add devlink and debugfs support for NPA DWRR registers. (Anshumali Gaur)  [Orabug: 39318904]
- cn20k-af: psw: Fix build warning (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix AI review comments. (Ratheesh Kannoth)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox to write to PSW MSIX registers (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add debugfs support for psw (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: introduce a mailbox to program PSW mbox msix vector (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add PSW AF API Notification queue support (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add FLR handler for PSW (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setup PSW timed polling structure tables (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW PCIe configuration (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW LF mapping (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add new mailbox for PSW doorbell configuration (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setups PSW FID resources (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setup PSW GID resources (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox to get PSW capabilities (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: register PSW AF interrupts (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: introduce PSW block (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: limit max periodic timers for cn20k (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Make default entries as x4. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeonxt2-af: npc: Fix bugs (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2_unregister_dl() after kernel reboot. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2vf_remove after kernel reboot. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: cn20k: Configure default CPT_AF_UCC_CTL for IPsec error codes (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: CN20k: add support for RFOE4 on half MP (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: Fix kernel crash during eswitch creation (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Use ZERO_OR_NULL_PTR for cgxchan2link_map (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add parser configuration for VLAN extraction (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support for single SBTAG parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix SDP channel base (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add MCS DSA tag parsing configuration support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Avoid any false positives for Altaf (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npc: Fix broadcast MCAM entry type on CN10K (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add platform check. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-bphy-netdev: add get_link_ksettings to fix SIOCETHTOOL error (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: dont free default mcam indexes (Ratheesh Kannoth)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Replace deprecated MSI-X API in CPRI netdev driver (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix kernel warn. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Mismatch stats. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Dont free PF default mcam indexes. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: FIx invalid access (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: dstats (Ratheesh Kannoth)  [Orabug: 39318904]
- octeonxt2-af: npc: cn20k: show enable/disable status. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: debugfs for virtual indexes (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix AI reviews (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Alloc default indexes during nix lf alloc (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix default mcam idx free (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: Remove SoC specific local variables. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix SC resource cleanup loop (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs: Add SC CAM bypass entry (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Modify the pcifunc VF mask (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: update the AFPFX_TRIGX reg offset (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: Fix rvu mbox registers offset (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2: sdp: Display backpressure status in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: add bounds check in nix_bp_enable (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: cn20k: Set a default value for res_meta_offset (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: Support mapping of individual slots to RVU block LFs (Subbaraya Sundeep)  [Orabug: 39318904]
- cn20k-af: ml: improve AF register access control (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: fetch list of LF IDs attached (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: fix using uninitialized partition ID (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable mapping LF to partition ID (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable mapping LF with partitions (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support ML lf alloc and free (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support fetching msix offset for ML (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support attach and detach of ML LFs (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: add support to fetch ML capabilities (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: implement ML mbox message handler (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: register ML interrupt handlers (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: implement hw resource setup and free (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable ML block probe and remove (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: add skeleton code for ML EB driver (Prince Takkar)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Add CN20K TX SecY policy bit support (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs: Set default mcs Id to 0. (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix memleak in npc_install flow (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix flags for HWWQE period timers (Mikko Suni)  [Orabug: 39318904]
- octeontx2-af: cn20k: Use physical address for AF-&gt;PF mbox (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: update fields of CPT_AF_LFX_CTL (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: cn20k: configure RX inline replay (Shashank Gupta)  [Orabug: 39318904]
- Octeontx2-af: cn20k: configure inline RQ mask (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Don't initialize ipsec queues for representor PF. (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-bphy-pf: CNF20ka: BPHY NIC PF driver for chiplet based BPHY NIX bypass mode (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: fix npc mbox structure defination (Mohit Kumar Parjapat)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Avoid SoC specific structures (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix get number of kw (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: cancel work before destroying wq. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx: switch: Fix compiler warnings. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: selftest: Use unique mbox ids (Linu Cherian)  [Orabug: 39318904]
- octeontx: pan: Disable WQ after unregister notifier (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Define new flag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix bugs. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Update mcam_idx for reply flow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Support ovs offloading (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Support mask as well for flow. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Pass tuple mask as well to flow. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Retrieve VLAN infor for L3 routing (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Add vlan tag as part of message (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Dont process events if switchdev is not up (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: make functions static (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix graceful shutdown. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Notify switchdev on NF table callback (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Support SNAT/DNAT routing (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Reject acceleration for invalid bridge (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Fix buffer overflow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix below kernel splat (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switchdev: Register for Route events. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switchdev: Forward route notifications. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switchdev: Add driver support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switchdev: L2 offload support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Remove devlink support for SDP VF NIC driver (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: Handle pool context address update in Aura context write (Ashwin Sekhar T K)  [Orabug: 39318904]
- octeontx2-af: CN20k: fix unused-function warning (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-pf: Move representor event handling into common file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix Rep link state sync up with PF/VFs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Fix DPC config mbox (Ashwin Sekhar T K)  [Orabug: 39318904]
- Octeontx2-pf: Fix transceiver details corruption (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: change GEN PF device ID (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20K: Fetch LBK supported channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix limiting SRIOV VF count logic (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: Fix KASAN slab-out-of-bounds error (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: Update irq affinity for mbox and flr (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add FLR/ME support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Fix possible memleak while mbox init (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Map alternative AF NIX_AF_GINT only for CN10K (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support to forward error interrupts to alt AF (Anil Kumar Reddy)  [Orabug: 39318904]
- octeontx2-af: Add support to forward flr to alternative AF (Anil Kumar Reddy)  [Orabug: 39318904]
- octeontx2-af: Update Alternative AF status (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: cn20k: Cleanup AF interrupt vector (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Do not hardcode AF bus number in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix rsrc_alloc debugfs file (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Add devlink option to reset MAC stats for debugging (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add devlink for defrag initiation (Ratheesh Kannoth)  [Orabug: 39318904]
- net: octeontx2: Fix coding style issues (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: Fix mcs string buffer size (Stefan Wiehler)  [Orabug: 39318904]
- octeontx2-af: Skip TM tree print for disabled SQs (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: debugfs: Add cn20k sdp rings info (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix kernel crash during NIX TM register dump (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: cpt: Add debug support for more than 64 engines. (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Update engine offset calculation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Add support to display "Autoneg" (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-vf: Set tc filter flag on vf netdev (Suman Ghosh)  [Orabug: 39318904]
- Octeontx2-pf: Update link mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-pf: Fix ethtool eeprom read logic (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: ethtool: Display physical connector type (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: restart interface when link settings are changed by user (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-sdpvf: Fix PTP options for SDP interfaces (Roy Franz)  [Orabug: 39318904]
- octeontx2-vf: Add partial ethtool support for SDP VFs (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Add page pool stats to ethtool (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Add missing changes in otx2_ethtool.c (Suman Ghosh)  [Orabug: 39318904]
- Octeontx2-pf: tc: fix egress ratelimiting (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Support to enable EDSA/Higig2 pkts parsing (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Using compound/head page ref count (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Fix NDC sync operation errors (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: cn20k: fix target address (Juan Garcia)  [Orabug: 39318904]
- octeontx2-pf: Check address for Null before free (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Add soft reset sequence in mcs_global_cfg() (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-pf: mcs: Don't account field alignment when installing TX SecY policy (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix start and end bit for scan config (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: npc: cn20k: Remove function (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: npc: cn20k: refactor code (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cgx: misc changes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: reset TL1 SW_XOFF before returning from link mode change (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Remove MAC address validation check (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Show count of dropped packets by DMAC filters (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Update mbox version (Sunil Goutham)  [Orabug: 39318904]
- cn10k-ipsec: Fix compilation with XFRM_OFFLOAD enabled (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-vf: Register dummy netdev for host PF VFs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Configure SQ default channel based on UP message (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Dereference only a valid pointer (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-vf: Fix VF mbox up message error on PTP RX enable (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: Add support for creating netdev interfaces for SDP VFs (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Add more debug messages (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Send UP messages to VF only when VF is up. (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Avoid null pointer dereference (Subbaraya Sundeep)  [Orabug: 39318904]
- cn10k-ipsec: fix uninitialized send queue during ESP offload (Shashank Gupta)  [Orabug: 39318904]
- cn10k-ipsec: Initialize ipsec queues on enabling IPsec (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: cn10k/cn20k: Update count_eot in NPA_LF_AURA_BATCH_FREE0 (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: persist netdev stats across routine operations (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-pf: Add self test (Linu Cherian)  [Orabug: 39318904]
- octeontx2-pf: Add ethtool -m option support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Skip dma map and unmap when IOMMU is bypassed (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-pf: Add NIXLF error/poison interrupt handlers (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-pf: Validation for TL1 Round robin priority (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: devlink param support to modify physical interface links. (Rakesh Babu)  [Orabug: 39318904]
- octeontx2-pf: Add devlink param to vary rbuf size (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Add devlink param to vary cqe size (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: CN20k: add multi chiplet support to NIX path (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Enable TX PTP timestamping on BPHY NIX link (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cn10k: Fix accessing invalid CSRs (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: fix fwdata NULL pointer dereference when RPM probe fails (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Map BPHY chiplet RPMs followed by compute chiplet RPMs (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Add chiplet RPM AF mbox support for port ready, get channel info messages. (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cnf20k: account for XCB RPM links in CGX link calculation (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Add support for chiplet based BPHY RPM driver as AF RVU extension block module (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Add BPHY chiplet, RPM, LMAC data to fwdata (Sai Krishna)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Register driver with PCI subsys ID (Anshumali Gaur)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Fix MSI-X init failure by setting both DMA masks (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20K: Add build and config support for CPRI PF driver to avoid module conflicts (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Fix CPRI MSI-X initialization failure (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Add workaround for gpint issue for CPRI pkt path (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Add cpri netdev driver support (Viswajith Murali)  [Orabug: 39318904]
- octeontx-bphy-netdev: Fix unexpected packet in netdev by ensuring proper PSW hardware write handling (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-bphy-netdev: allow forcing ts steps cnt (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix fec counters reporting (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix ecpri pkt stats update (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix ecpri type5 handling (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix a deadlock in cpri (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix race condition for timestamp packets (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix kernel crash by using proper max PSM queue count (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: protect psm queue access (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix debugfs memleak (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Detect DL circular buffer full (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix rsfec stats reading (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Support for eCPRI MsgType5 timestamping (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Use correct netdev priv structure for debugging (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: disable CPRI RX on cleanup (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: ignore mcs untagged error (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: disable rx on RFOEs on exit (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix crash issue during initialization of cpri, rfoe interfaces on set MAC address (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: OcteonTX2 Base PHY RFOE netdev driver (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver msix, interrupt handling (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Move DPI block reset handling to AF extension block driver (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver channel table mbox support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver mbox support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver initial support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cn20k: Don't reset the PF_DISC register (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: CN20K: update RPM links (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add block discovery register (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix PTP RX enable mbox fail issue over NIC VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Modify NIX register offset value for CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Validate NIX maximum LFs correctly (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix incorrect BPID initialization for CPT channels (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow CPT PF access to CPT_AF_GRPX_THR (Shashank Gupta)  [Orabug: 39318904]
- octeontx2-af: cn20k: support packet data buffer (pdb) configuration (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Set LBK channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix config parameter check when disable inline queue (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable CPT parse and Frag info header byte swap (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Add an MCAM entry to count CPT 2nd pass miss packets (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: support overriding aura to zero for second pass (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Use proper mask to get max CPT LF's (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: allow mbox access from CPT VFs for backward compatibility (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: Drop CPT PF/VF check for relevant mboxes (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Change CPT channels configuration (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow CPT PF access to CPTX_AF_CTX_PSP_TIMER_CTL (Shashank Gupta)  [Orabug: 39318904]
- octeontx2-af: cn20k: change CPT register address as per latest csr (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow access to CPT_AF_UCCX_CTL (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: CN20K channel configuration (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable RXC on inline inbound cptlf (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix RXC flush and cleanup sequence (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add CPT CTX flush support (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: fix CPT ctx flush (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: cn20k: Setup CPT reassembly Queue Configuration Register (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Move RXC specific functions (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: cn20k: handle multi-queue reassembly teardown (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for NIX RX inline configuration (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for CPT RX inline configuration (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for CPT RX queue allocation (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mbox to configure rx inline nixlf (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mbox to configure rx inline profile (Bharat Bhushan)  [Orabug: 39318904]
- crypto: octeontx2: Add new mailbox to set queue priority (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add rxc teardown support (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add queue id to rxc time config mbox (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add cpt stats mailbox support (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: add FLT interrupts (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: Unify HW interrupt APIs (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx-af: cpt: Get CPT PF number using PF Device ID (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Update max engine calculation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Add TC rules support for CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Set correct sequence for carrier off and tx queue stop (Suman Ghosh)  [Orabug: 39318904]
- octeontx2: Fix klockwork issues. (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Free queue memory allocated sq timestamp (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Check for DMAC extraction support before setting DMAC based hardware filter for a VF (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Move REP devlink APIs to separate file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix representor up notification events (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Use ews_rules value to update REP tcam rules (Geetha sowjanya)  [Orabug: 39318904]
- Octeontx2-af: Change args for rvu_get_pf (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add validation before accessing fwdata (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: map management port always to first PF (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: replace generic error codes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: link mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Assign CGX id from PCI revision id (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Remove MAC address validation check (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: lmac validation with is_lmac_valid (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix compilation warning/klockwork issues (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: configure 802.3 pause frames in SGMII/QSGMII mode (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add new CGX_CMDs to set and get PHY modulation type (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Do not allow VFs to overwrite PKIND config (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Put CGX LMAC also in Higig2 mode (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-sdp: Add FLR interrupts for Host PFs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Refactor SDP interrupts code (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Fix SDP channel numbers in NPC rules (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Check whether SDP block is present before access (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: sdp: Fix address range assignment logic (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: sdp: Maintain host to RVU GEN PF mapping (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: misc SDP fixes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx-af: cn20k: Manage rings allocation and freeing (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: CN20K: SDP mbox framework (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: CN20K: SDP extension driver (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-pf: enable AF_XDP zero copy support (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix clearing TL3_TL2X_LINKX_CFG[ENA] during SMQ flush to drop packets (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Fix ROCEV2 RSS hashing QP ID length (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Allow to set CPT result address offset (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for NIX flow vector configuration (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: add ROCEv2 header for RSS hashing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Update lbk maximum frame size as per CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: fix TX scheduler count (Satha Rao)  [Orabug: 39318904]
- octeontx2-af: Fix the issue of infinite loop in nix_aq_reset (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Misc changes in NIX block (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Dump hw register state on error (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add new mailbox to configure LSO alt flags (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Extend SPI to SA index translation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: notify VF about ptp event (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: Sending tsc value to the userspace (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: Support for PTP notification to PF (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: npa: fix DPC permit register access (Ashwin Sekhar T K)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add DPC support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add debugfs support for Halo (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add NPA Halo support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Fix number of entries in the kpu3 cam (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix subbank count (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix number of entries in the kpu2 cam (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add mbox to read default rule (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: kpu: Input validation check. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: kpu: Fix lodable profile issue (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Convert to C99 flexible array (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Restore stats in defrag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Flow delete and free mbox (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Add traces in NPC mailboxes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix KPU9 state variable for ROCEV2 (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add support for ROCEv2 header parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add more VLAN tag parsing in case of E-tag (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flags for cn20k (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Avoid updating cn10k registers during cn20k reboot (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Do not access match stats for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: Update NPC CSRs (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix out of bound access in entry2counter array (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix initialization of mcam's entry2target_pffunc field (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flag extraction in parse nibble (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix CPT CGX channel mask for cn20k (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flag in KPU profile for CN20K (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: fix mcam hit counter (Satheesh Paul)  [Orabug: 39318904]
- Revert "octeontx2-af: npc: cn20k: Get base steer rule index." (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: fix rule type for LBK VF (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: Fix failed to load custom pfl warning (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: add changes to update CPT pad length offset in KPU (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix search order (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: Use dev_dbg() (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix compilation warnings (Sunil Goutham)  [Orabug: 39318904]
- octeontx2: cn20k: npc: Set action2 for x2 entries. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable action2 programming in npc (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Set default profile DYNAMIC (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix csr register field offset. (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Reject request for x4 entries in x2 profile. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Alloc mcam entry for install flow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Disable fw load faiure warning (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Load custom kpu profile from filesystem. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix install flow priority (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add support for custom mkex profiles (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Get base steer rule index. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Stats support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cn20k: Reject mcam alloc mbox with invalid keytype (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Reserve x4 key mcam entries for ntuple (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Get kex related info from PF. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix parse result nibble mask reading. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Set correct nibble bits for cn20k (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix parse nibble mask (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Avoid accessing cn10k registers (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add new mailboxes for CN20K silicon (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix npc_mcam_get_hit_status mbox for cn10k (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Convert vidx to mcam_idx in mbox handler (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add an mbox interface to defrag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: defragmentation support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Introduce virtual mcam index (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Validate mcam index before enable/disable (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add new mailboxes to get kex config and free counts (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Use common APIs to read/write/copy/enable mcam entry (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Add a new mbox to read/write MCAM hit status (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: debugfs support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Use common APIs to alloc/free/get mcam index. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Allocate default mcam indexes. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Modify alloc entry mailbox (Suman Ghosh)  [Orabug: 39318904]
- ocetontx2-af: npc: cn20k: MKEX profile support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: KPM profile changes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Index management. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: Fix klockwork issues. (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix Support of FDSA tag (George Cherian)  [Orabug: 39318904]
- octeontx2-af: Support for FDSA tag (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Adding changes to parse stacked VLANs (Kiran Kumar K)  [Orabug: 39318904]
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix issue with GRE parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add support to parse more VLAN headers (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix issue with IPV6 GRE and multi VLAN (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add KPU changes to parse fabric path header (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add few missing changes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: allow second pass pkts via default ucast entry (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: suppress kpu profile loading warning (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: use cpt channel mask in flow install path (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: Add NPC support to filter GTP-U and GTP-C packets based on TEID (Suman Ghosh)  [Orabug: 39318904]
- octeontx2: cn20k: Assign unique MCS IDs based on PCI enumeration (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-pf: Choose macsec encryption offload per packet (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: mcs: Use new SCI CAM in hardware (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: mcs: Fix mcs resources free on PF shutdown (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Add devlink parameter to toggle MCS bypass mode (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Display port mapped stats for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add MCS LMAC channel and count configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs set mcs id and silicon check (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix mcs tx_sa_map API (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mcs PN threshold support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: MCS add port configure APIs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: Add MCS parser configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix mcs register offsets (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix unsupported secy stats read (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add MCS support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: mcs: Remove SA stats support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cnf10k-b: mcs: Fix stats reg address (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: rvu: enable mcs fips mailboxes (Ankur Dwivedi)  [Orabug: 39318904]
- octeontx2-af: mcs: add mailboxes for fips (Ankur Dwivedi)  [Orabug: 39318904]
- octeontx2-af: sso: clear all the sets on init (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: tim: add ring priority support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: update TIM interval support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: moderate SSO AF error interrupts (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: lower TIM bucket skip IRQ log level (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: remove GTI clock adjustment (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: update xaq aura offset (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: cleanup SSO EVA on LF reset (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO HW info mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO AGGR config and stats mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO EVA error interrupts (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: update masks for CN20K resources (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: Fixed compilation warnings (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: fix interval flag check (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add TIM hardware info mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add TIM HWWQE mbox support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add mbox to capture counters (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: reveal only TIM params that are available (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: add TIM error af interrupt handlers (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: clear state on TIM ring disable (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: disable preemption when enabling TIM (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: account for cycle wraparound (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: prevent TIM register read reorder (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: fix arguments passed to XAQ aura deinit (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: debugfs: fix undefined SSO register access (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: update TIM adjust GTI errata silicons (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: update TIM adjust GTI errata silicons (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: add TIM adjust GTI errata workaround (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: cn10k: devlink params to configure TIM (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: TIM: Set conditional clock always on (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Apply relevant HW issue workarounds for 96xx B0 silicon (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: Add SSO and TIM units support to the AF driver (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: enable rxc with lookaside cpt lf (Vidya Sagar Velumuri)  [Orabug: 39318904]
- octeontx2-af: fix issue with spitosa table teardown (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: fix cflags include paths (Wladislav Wiebe)  [Orabug: 39318904]
- octeontx2-af: Move out REE mbox messages (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add generic mbox handler for Eblock (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Use AF extension block interface (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add RVU AF extension block interface (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Introducing REE block for 98xx (Smadar Fuks)  [Orabug: 39318904]
- octeontx2-af: fix VF bringup affecting PF promiscous state (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: consider mode when using cpt base channel for bp (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: Update minimum receive frame size (Sathesh Edara)  [Orabug: 39318904]
- octeontx2-af: set default min and max rx len for CPT link (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: add NIX mbox message to get HW info (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: fix inline inbound IPsec configuration (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: support for custom L2 header (Satheesh Paul A)  [Orabug: 39318904]
- octeontx2-af: fix to get different rq mask (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: poll for tx link credits before link mode change (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Handle physical link state change requests (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add mbox to alloc/free BPIDs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Dynamically allocate bpids for CPT and LBK (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support for SPI to SA index translation (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Update HW workarounds for 96xx C0, 98xx and F95xx B0 chips (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add devlink support to configure TL1 RR_PRIO (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: add support for CPT second pass (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: add new mbox to support sync cycle on rx path (Satha Rao)  [Orabug: 39318904]
- octeontx2-af: add support for changing vlan tpid (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-pf: Fix devm_kcalloc() error checking (Dan Carpenter)  [Orabug: 39318904]
- octeontx2-pf: Use new bandwidth profiles in receive queue (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Display new bandwidth profiles too in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Accommodate more bandwidth profiles for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Initialize new NIX SQ context for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Initialize cn20k specific aura and pool contexts (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Skip NDC operations for cn20k (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Extend debugfs support for cn20k NPA (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add cn20k NPA block contexts (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Extend debugfs support for cn20k NIX (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Add cn20k NIX block contexts (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Simplify context writing and reading to hardware (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: convert to ndo_hwtstamp API (Vadim Fedorenko)  [Orabug: 39318904]
- Octeontx2-af: Fix pci_alloc_irq_vectors() return value check (Harshit Mogalapalli)  [Orabug: 39318904]
- Octeontx2-af: Fix missing error code in cgx_probe() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-pf: fix bitmap leak (Bo Sun)  [Orabug: 39318904]
- octeontx2-vf: fix bitmap leak (Bo Sun)  [Orabug: 39318904]
- octeontx2-af: Remove unused declarations (Yue Haibing)  [Orabug: 39318904]
- Octeontx2-af: Fix NIX X2P calibration failures (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-vf: Fix max packet length errors (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Broadcast XON on all channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: use unsigned int as iterator for unsigned values (Simon Horman)  [Orabug: 39318904]
- net: Fix typos (Bjorn Helgaas)  [Orabug: 39318904]
- Octeontx2-af: Debugfs support for firmware data (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: RPM: Update DMA mask (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Disable stale DMAC filters (Subbaraya Sundeep)  [Orabug: 39318904]
- Octeontx2-af: Add programmed macaddr to RVU pfvf (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix error code in rvu_mbox_init() (Dan Carpenter)  [Orabug: 39318904]
- Octeontx2-pf: ethtool: support multi advertise mode (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Introduce mode group index (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx-pf: Update SGMII mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix rvu_mbox_init return path (Subbaraya Sundeep)  [Orabug: 39318904]
- Octeontx2-pf: Fix Backpresure configuration (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: CN20K mbox implementation between PF-VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20K mbox implementation for AF's VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: CN20K mbox REQ/ACK implementation for NIC PF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k mbox to support AF REQ/ACK functionality (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k basic mbox operations and structures (Sai Krishna)  [Orabug: 39318904]
- octeontx2: Set appropriate PF, VF masks and shifts based on silicon (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Avoid typecasts by simplifying otx2_atomic64_add macro (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Annotate mmio regions as __iomem (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: macsec: Get MACSEC capability flag from AF (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Add MACSEC capability flag (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Send Link events one by one (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: NPC: Clear Unicast rule on nixlf detach (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Avoid adding dcbnl_ops for LBK and SDP vf (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Add tracepoint for NIX_PARSE_S (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Add new tracepoint otx2_msg_status (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Add pcifunc also to mailbox tracepoints (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Display names for CPT and UP messages (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: convert dev_dbg to tracepoint in mbox (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Fix ethtool support for SDP representors (Hariprasad Kelam)  [Orabug: 39318904]
- net: octeontx2: Use pure PCI devres API (Philipp Stanner)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP: code clean up (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Remove unused rvu_npc_enable_bcast_entry (Dr. David Alan Gilbert)  [Orabug: 39318904]
- xfrm: Add explicit dev to .xdo_dev_state_{add,delete,free} (Cosmin Ratiu)  [Orabug: 39318904]
- octeontx2-pf: handle otx2_mbox_get_rsp errors (Chenyuan Yang)  [Orabug: 39318904]
- net: octeontx2: Handle XDP_ABORTED and XDP invalid as XDP_DROP (Lorenzo Bianconi)  [Orabug: 39318904]
- octeontx2-af: mcs: Remove redundant 'flush_workqueue()' calls (Chen Ni)  [Orabug: 39318904]
- net: octeontx2: Add metadata support for xdp mode (Lorenzo Bianconi)  [Orabug: 39318904]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 39318904]
- octeontx2: hide unused label (Arnd Bergmann)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP zero copy transmit support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Prepare for AF_XDP (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Reconfigure RSS table after enabling AF_XDP zerocopy on rx queue (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP zero copy receive support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: use xdp_return_frame() to free xdp buffers (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: mcs: Remove dead code and semi-colon from rsrc_name() (Nihar Chaithanya)  [Orabug: 39318904]
- octeontx2-pf: fix error handling of devlink port in rvu_rep_create() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-pf: fix netdev memory leak in rvu_rep_create() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-af: fix build regression without CONFIG_DCB (Arnd Bergmann)  [Orabug: 39318904]
- cn10k-ipsec: Fix compilation error when CONFIG_XFRM_OFFLOAD disabled (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Fix installation of PF multicast rule (Geetha sowjanya)  [Orabug: 39318904]
- cn10k-ipsec: Enable outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Allow ipsec crypto offload for skb with SA (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Process outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Add SA add/del support for outb ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Init hardware for outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Disable backpressure between CPT and NIX (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Move skb fragment map/unmap to common code (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: map skb data as device writeable (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Fix SDP MAC link credits configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Fix spelling mistake "reprentator" -&gt; "representor" (Colin Ian King)  [Orabug: 39318904]
- octeontx2-pf: Adds TC offload support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Implement offload stats ndo for representors (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add devlink port support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add representors for sdp MAC (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Configure VF mtu via representor (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add support to sync link state between representor and VFs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Get VF stats via representor (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add packet path between representor and VF (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add basic net_device_ops (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Create representor netdev (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: RVU representor driver (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Knobs for NPC default rule counters (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Refactor few NPC mcam APIs (Linu Cherian)  [Orabug: 39318904]
- octeontx2-pf: Move shared APIs to header file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Reuse PF max mtu value (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add new APIs for queue memory alloc/free. (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Define common API for HW resources configuration (Geetha sowjanya)  [Orabug: 39318904]
- net: marvell: use ethtool string helpers (Rosen Penev)  [Orabug: 39318904]
- uek: kabi: update kABI files for new symbols (Saeed Mirzamohammadi)  [Orabug: 39268116]
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39167615]  {CVE-2026-31402}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39110670]  {CVE-2026-23278}
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39103229]  {CVE-2026-23270}</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.5.el10uek]" date="1779192000">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39407652]  {CVE-2026-46333}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.6.el10uek]" date="1779796800">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39442660]  {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39442660]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.7.el10uek]" date="1779969600">- tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi)  [Orabug: 39456024]
- tap: free page on error paths in tap_get_user_xdp() (Weiming Shi)  [Orabug: 39456024]
- tun: free page on short-frame rejection in tun_xdp_one() (Weiming Shi)  [Orabug: 39456024]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.7.1.el10uek]" date="1780315200">- smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39474418]</changelog>
</package>
<package pkgid="548c2ec3149e8b7a714ec86200e7021dc50e4686" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="100.28.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.2.el10uek]" date="1751198400">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
</package>
<package pkgid="d3461c680f033597cfaf97dbec71a7a984d64996" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="100.28.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.el10uek]" date="1743681600">- block: prevent calls to should_fail_bio() optimized by gcc (Prasad Singamsetty)  [Orabug: 37782458]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)   
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]  
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]  
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
</package>
<package pkgid="bc6fbbc8b016c1b57502b2ef71c22722c145e9d2" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="101.33.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge) [Orabug: 37976747] {CVE-2025-37903}
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi) [Orabug: 37976752] {CVE-2025-37905}
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [Orabug: 37976858] {CVE-2025-37932}
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski) [Orabug: 37976760] {CVE-2025-37907}
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang) [Orabug: 37976762] {CVE-2025-37908}
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh Edara) [Orabug: 37976864] {CVE-2025-37933}
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan) [Orabug: 37976765] {CVE-2025-37909}
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon) [Orabug: 37976771] {CVE-2025-37910}
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang) [Orabug: 37976728] {CVE-2025-37894}
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein) [Orabug: 37976869] {CVE-2025-37934}
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab) [Orabug: 37976773] {CVE-2025-37911}
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh Ap)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya Kn) [Orabug: 37976731] {CVE-2025-37895}
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe) [Orabug: 37976872] {CVE-2025-37935}
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai) [Orabug: 37970918] {CVE-2025-37891}
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Luoxuanqiang) [Orabug: 37976779] {CVE-2025-37912}
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976783] {CVE-2025-37913}
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976788] {CVE-2025-37914}
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira) [Orabug: 37970915] {CVE-2025-37890}
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976792] {CVE-2025-37915}
- pds_core: remove write-after-free of client_id (Shannon Nelson) [Orabug: 37976797] {CVE-2025-37916}
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud) [Orabug: 37976802] {CVE-2025-37917}
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu) [Orabug: 37976804] {CVE-2025-37918}
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu) [Orabug: 37976806] {CVE-2025-37919}
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (Eryk Kubanski) [Orabug: 37976809] {CVE-2025-37920}
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel) [Orabug: 37976815] {CVE-2025-37921}
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov) [Orabug: 37976734] {CVE-2025-37897}
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom) [Orabug: 37976819] {CVE-2025-37922}
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Sun Peng Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park) [Orabug: 37976821] {CVE-2025-37923}
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan) [Orabug: 37976738] {CVE-2025-37899}
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan) [Orabug: 37976828] {CVE-2025-37924}
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon) [Orabug: 37976832] {CVE-2025-37926}
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen) [Orabug: 37976741] {CVE-2025-37900}
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov) [Orabug: 37976836] {CVE-2025-37927}
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (Longping Wei) [Orabug: 37976844] {CVE-2025-37928}
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Xu Wang) [Orabug: 37977118] {CVE-2025-37990}
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold) [Orabug: 37976744] {CVE-2025-37901}
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson) [Orabug: 37976874] {CVE-2025-37936}
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller) [Orabug: 37977127] {CVE-2025-37991}
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon) [Orabug: 37977182] {CVE-2025-37929}
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner) [Orabug: 37976850] {CVE-2025-37930}
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik) [Orabug: 37976853] {CVE-2025-37931}
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya) [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil) [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert) [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter) [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King) [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche) [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert) [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar) [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang) [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli) [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre) [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta) [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon) [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon) [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth) [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth) [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick) [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli) [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval) [Orabug: 37930100] {CVE-2025-37821}
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang) [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed) [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan) [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.31.1.el10uek]" date="1748952000">- LTS version: v6.12.31 (Jack Vogel)
- drm/gem: Internally test import_attach for imported objects (Thomas Zimmermann)
- x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers (Balbir Singh)
- i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() (Nathan Chancellor)
- pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group() (Dan Carpenter)
- watchdog: aspeed: fix 64-bit division (Arnd Bergmann)
- drm/amdkfd: Correct F8_MODE for gfx950 (Amber Lin)
- serial: sh-sci: Save and restore more registers (Geert Uytterhoeven)
- bpf: abort verification if env-&gt;cur_state-&gt;loop_entry != NULL (Eduard Zingerman)
- drm/amd/display: Exit idle optimizations before accessing PHY (Ovidiu Bunea)
- kbuild: Properly disable -Wunterminated-string-initialization for clang (Nathan Chancellor)
- Fix mis-uses of 'cc-option' for warning disablement (Linus Torvalds)
- gcc-15: disable '-Wunterminated-string-initialization' entirely for now (Linus Torvalds)
- gcc-15: make 'unterminated string initialization' just a warning (Linus Torvalds)
- err.h: move IOMEM_ERR_PTR() to err.h (Raag Jadav)
- spi: spi-fsl-dspi: Reset SR flags before sending a new message (Larisa Grigore)
- spi: spi-fsl-dspi: Halt the module after a new message transfer (Bogdan-Gabriel Roman)
- spi: spi-fsl-dspi: restrict register range for regmap access (Larisa Grigore)
- spi: use container_of_cont() for to_spi_device() (Greg Kroah-Hartman)
- platform/x86: think-lmi: Fix attribute name usage for non-compliant items (Mark Pearson)
- ksmbd: fix stream write failure (Namjae Jeon)
- Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection" (Jernej Skrabec)
- Bluetooth: btmtksdio: Do close if SDIO card removed without close (Chris Lu)
- Bluetooth: btmtksdio: Check function enabled before doing close (Chris Lu)
- nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() (Ryusuke Konishi)
- mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled (Ignacio Moreno Gonzalez)
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Tianyang Zhang)
- memcg: always call cond_resched() after fn() (Breno Leitao)
- highmem: add folio_test_partial_kmap() (Matthew Wilcox)
- Input: xpad - add more controllers (Vicki Pfau)
- Revert "drm/amd: Keep display off while going into S4" (Mario Limonciello)
- smb: client: Reset all search buffer pointers when releasing buffer (Zhaolong Wang)
- arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (Gabor Juhos)
- smb: client: Fix use-after-free in cifs_fill_dirent (Zhaolong Wang) [Orabug: 38094970] {CVE-2025-38051}
- drm/edid: fixed the bug that hdr metadata was not reset (Feijuan Li)
- thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature (Zhang Rui)
- platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin) [Orabug: 38095141] {CVE-2025-38077}
- pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
- pmdomain: renesas: rcar: Remove obsolete nullify checks (Geert Uytterhoeven)
- vmxnet3: update MTU after device quiesce (Ronak Doshi)
- net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
- can: kvaser_pciefd: Fix echo_skb race (Axel Forsman)
- can: kvaser_pciefd: Continue parsing DMA buf after dropped RX (Axel Forsman)
- llc: fix data loss when reading from a socket in llc_ui_recvmsg() (Gavrilov Ilia)
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10 (Ed Burcher)
- ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [Orabug: 38095145] {CVE-2025-38078}
- ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction (Peter Ujfalusi)
- ASoc: SOF: topology: connect DAI to a single DAI link (Kai Vehmanen)
- ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext (Peter Ujfalusi)
- can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp) [Orabug: 38049369] {CVE-2025-38003}
- can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 38049374] {CVE-2025-38004}
- can: slcan: allow reception of short error messages (Carlos Sanchez)
- padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094842] {CVE-2025-38031}
- crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [Orabug: 38095153] {CVE-2025-38079}
- clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe() (André Draszik)
- octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG (Geetha Sowjanya)
- octeontx2-af: Set LMT_ENA bit for APR table entries (Subbaraya Sundeep)
- net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang) [Orabug: 38094978] {CVE-2025-38052}
- octeontx2-pf: Add AF_XDP non-zero copy support (Suman Ghosh)
- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [Orabug: 38049357] {CVE-2025-38000}
- idpf: fix idpf_vport_splitq_napi_poll() (Eric Dumazet)
- io_uring: fix overflow resched cqe reordering (Pavel Begunkov)
- net: lan743x: Restore SGMII CTRL register on resume (Thangaraj Samynathan)
- net: dwmac-sun8i: Use parsed internal PHY address instead of 1 (Paul Kocialkowski)
- pinctrl: qcom: switch to devm_register_sys_off_handler() (Dmitry Baryshkov)
- loop: don't require -&gt;write_iter for writable files in loop_configure (Christoph Hellwig)
- idpf: fix null-ptr-deref in idpf_features_check (Pavan Kumar Linga) [Orabug: 38094982] {CVE-2025-38053}
- ice: Fix LACP bonds without SRIOV environment (Dave Ertman)
- ice: fix vf-&gt;num_mac count with port representors (Jacob Keller)
- bridge: netfilter: Fix forwarding of fragmented packets (Ido Schimmel)
- ptp: ocp: Limit signal/freq counts in summary output functions (Sagi Maimon) [Orabug: 38094984] {CVE-2025-38054}
- Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling (En-Wei Wu)
- Bluetooth: L2CAP: Fix not checking l2cap_chan security level (Luiz Augusto von Dentz)
- perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter) [Orabug: 38094988] {CVE-2025-38055}
- irqchip/riscv-imsic: Start local sync timer on correct CPU (Andrew Bresticker)
- ASoC: SOF: Intel: hda: Fix UAF when reloading module (Tavian Barnes) [Orabug: 38094991] {CVE-2025-38056}
- devres: Introduce devm_kmemdup_array() (Raag Jadav)
- driver core: Split devres APIs to device/devres.h (Andy Shevchenko)
- dmaengine: fsl-edma: Fix return code for unhandled interrupts (Stefan Wahren)
- dmaengine: idxd: Fix -&gt;poll() return value (Dave Jiang)
- xfrm: Sanitize marks before insert (Paul Chaignon)
- clk: sunxi-ng: d1: Add missing divider for MMC mod clocks (Andre Przywara)
- remoteproc: qcom_wcnss: Fix on platforms without fallback regulators (Matti Lehtimäki)
- kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() (David Hildenbrand)
- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (Seongman Lee)
- dmaengine: idxd: Fix allowing write() from different address spaces (Vinicius Costa Gomes)
- xfrm: Fix UDP GRO handling for some corner cases (Tobias Brunner)
- espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca)
- espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094993] {CVE-2025-38057}
- soundwire: bus: Fix race on the creation of the IRQ domain (Charles Keepax)
- __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [Orabug: 38095000] {CVE-2025-38058}
- drm/amd/display: Call FP Protect Before Mode Programming/Mode Support (Austin Zheng)
- xenbus: Allow PVH dom0 a non-local xenstore (Jason Andryuk)
- x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust &gt;= 1.88 (Paweł Anikiel) [Orabug: 38094847] {CVE-2025-38033}
- wifi: iwlwifi: add support for Killer on MTL (Johannes Berg)
- block: only update request sector if needed (Johannes Thumshirn)
- tools: ynl-gen: validate 0 len strings from kernel (David Wei)
- btrfs: avoid NULL pointer dereference if no valid csum tree (Qu Wenruo) [Orabug: 38095010] {CVE-2025-38059}
- btrfs: handle empty eb-&gt;folios in num_extent_folios() (Boris Burkov)
- btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [Orabug: 38094856] {CVE-2025-38034}
- btrfs: compression: adjust cb-&gt;compressed_folios allocation type (Kees Cook)
- ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers (Stefan Binding)
- cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function (Pali Rohár)
- cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info() (Pali Rohár)
- io_uring/fdinfo: annotate racy sq/cq head/tail reads (Jens Axboe)
- nvmet-tcp: don't restore null sk_state_change (Alistair Francis) [Orabug: 38094863] {CVE-2025-38035}
- ALSA: usb-audio: Fix duplicated name in MIDI substream names (Takashi Iwai)
- nvme-pci: add quirks for WDC Blue SN550 15b7:5009 (Guan Wentao)
- nvme-pci: add quirks for device 126f:1001 (Guan Wentao)
- ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 (Takashi Iwai)
- ASoC: cs42l43: Disable headphone clamps during type detection (Charles Keepax)
- platform/x86: ideapad-laptop: add support for some new buttons (Gašper Nemgar)
- platform/x86: asus-wmi: Disable OOBE state after resume from hibernation (Pavel Nikulin)
- platform/x86/intel: hid: Add Pantherlake support (Saranya Gopal)
- smb: server: smb2pdu: check return value of xa_store() (Salah Triki)
- pinctrl: meson: define the pull up/down resistor value as 60 kOhm (Martin Blumenstingl)
- book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n (Ritesh Harjani)
- ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of() (Chenyuan Yang)
- drm: Add valid clones check (Jessica Zhang)
- drm/panel-edp: Add Starry 116KHD024006 (Douglas Anderson)
- drm/buddy: fix issue that force_merge cannot free all roots (Lin Cao)
- drm/atomic: clarify the rules around drm_atomic_state-&gt;allow_modeset (Simona Vetter)
- drm/xe: Reject BO eviction if BO is bound to current VM (Oak Zeng)
- drm/xe/sa: Always call drm_suballoc_manager_fini() (Michal Wajdeczko)
- wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event (Ching-Te Ku)
- drm/xe: Do not attempt to bootstrap VF in execlists mode (Maarten Lankhorst)
- drm/xe: Move suballocator init to after display init (Maarten Lankhorst)
- wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (P Praneesh)
- drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE (Zhi Wang)
- drm: bridge: adv7511: fill stream capabilities (Olivier Moysan)
- wifi: ath12k: Fix end offset bit definition in monitor ring descriptor (P Praneesh)
- wifi: ath12k: Fetch regdb.bin file from board-2.bin (Aaradhana Sahu)
- wifi: ath9k: return by of_get_mac_address (Rosen Penev)
- drm/xe/pf: Reset GuC VF config when unprovisioning critical resource (Michal Wajdeczko)
- accel/qaic: Mask out SR-IOV PCI resources (Youssef Samir)
- wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override (Nicolas Escande)
- regulator: ad5398: Add device tree support (Isaac Scott)
- spi: zynqmp-gqspi: Always acknowledge interrupts (Sean Anderson)
- wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet (Ping-Ke Shih)
- wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate (Bitterblue Smith)
- wifi: rtl8xxxu: retry firmware download on error (Soeren Moch)
- clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation (Lad Prabhakar)
- perf/amd/ibs: Fix -&gt;config to sample period calculation for OP PMU (Ravi Bangoria)
- perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (Ravi Bangoria)
- firmware: arm_scmi: Relax duplicate name constraint across protocol ids (Sudeep Holla)
- bpftool: Fix readlink usage in get_fd_type (Viktor Malik)
- bpf: Use kallsyms to find the function name of a struct_ops's stub function (Martin Kafai Lau)
- drm/ast: Find VBIOS mode from regular display size (Thomas Zimmermann)
- dm vdo: use a short static string for thread name prefix (Matthew Sakai)
- dm vdo indexer: prevent unterminated string warning (Chung Chung)
- irqchip/riscv-aplic: Add support for hart indexes (Vladimir Kondratiev)
- ASoC: rt722-sdca: Add some missing readable registers (Charles Keepax)
- ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode (Cezary Rojewski)
- arm64: zynqmp: add clock-output-names property in clock nodes (Naman Trivedi Manojbhai)
- HID: usbkbd: Fix the bit shift number for LED_KANA (Junan)
- wifi: ath12k: Avoid napi_sync() before napi_enable() (Avula Sri Charan)
- scsi: st: Restore some drive settings after reset (Kai Mäkisara)
- net/mana: fix warning in the writer of client oob (Konstantin Taranov)
- drm/xe/relay: Don't use GFP_KERNEL for new transactions (Michal Wajdeczko)
- ice: count combined queues using Rx/Tx count (Michal Swiatkowski)
- perf: Avoid the read if the count is already updated (Peter Zijlstra)
- rcu: fix header guard for rcu_all_qs() (Ankur Arora)
- rcu: handle unstable rdp in rcu_read_unlock_strict() (Ankur Arora)
- rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y (Ankur Arora)
- ice: treat dyn_allowed only as suggestion (Michal Swiatkowski)
- ice: init flow director before RDMA (Michal Swiatkowski)
- bridge: mdb: Allow replace of a host-joined group (Petr Machata)
- net: flush_backlog() small changes (Eric Dumazet)
- r8169: don't scan PHY addresses &gt; 0 (Heiner Kallweit)
- ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only (Geert Uytterhoeven)
- vxlan: Annotate FDB data races (Ido Schimmel) [Orabug: 38094879] {CVE-2025-38037}
- cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (Dhananjay Ugwekar) [Orabug: 38094888] {CVE-2025-38038}
- tools: ynl-gen: don't output external constants (Jakub Kicinski)
- eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs (Alexander Duyck)
- drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0 (Cristian Ciocaltea)
- media: qcom: camss: Add default case in vfe_src_pad_code (Depeng Shao)
- media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available (Depeng Shao)
- f2fs: introduce f2fs_base_attr for global sysfs entries (Jaegeuk Kim)
- hwmon: (xgene-hwmon) use appropriate type for the latency value (Andrey Vatoropin)
- tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options (Len Brown)
- net: page_pool: avoid false positive warning if NAPI was never added (Jakub Kicinski)
- clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs (Jordan Crouse)
- wifi: rtw89: call power_on ahead before selecting firmware (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before accessing (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before getting its size (Ping-Ke Shih)
- wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang (Ching-Te Ku)
- wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix download_firmware_validate() for RTL8814AU (Bitterblue Smith)
- ext4: remove writable userspace mappings before truncating page cache (Zhang Yi)
- ext4: don't write back data before punch hole in nojournal mode (Zhang Yi)
- leds: trigger: netdev: Configure LED blink interval for HW offload (Marek Vasut)
- pstore: Change kmsg_bytes storage size to u32 (Kees Cook)
- iio: adc: ad7944: don't use storagebits for sizing (David Lechner)
- r8152: add vendor/device ID pair for Dell Alienware AW1022z (Aleksander Jan Bajkowski)
- ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). (Kuniyuki Iwashima)
- arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src (Athira Rajeev)
- powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (Gaurav Batra)
- powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Gaurav Batra)
- net: fec: Refactor MAC reset to function (Csókás Bence)
- wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx (Emmanuel Grumbach)
- wifi: mac80211: remove misplaced drv_mgd_complete_tx() call (Johannes Berg)
- wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() (Johannes Berg)
- wifi: iwlwifi: don't warn during reprobe (Miri Korenblit)
- wifi: iwlwifi: use correct IMR dump variable (Johannes Berg)
- mptcp: pm: userspace: flags: clearer msg if no remote addr (Matthieu Baerts)
- wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV (P Praneesh)
- xfrm: prevent high SEQ input in non-ESN mode (Leon Romanovsky)
- drm/v3d: Add clock handling (Stefan Wahren)
- net/mlx5e: reduce the max log mpwrq sz for ECPF and reps (William Tu)
- net/mlx5e: reduce rep rxq depth to 256 for ECPF (William Tu)
- net/mlx5e: set the tx_queue_len for pfifo_fast (William Tu)
- net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB (Alexei Lazar)
- net/mlx5: XDP, Enable TX side XDP multi-buffer support (Alexei Lazar)
- scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr() (Chaohai Chen)
- drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer() (Alex Deucher)
- drm/amdgpu: enlarge the VBIOS binary size limit (Morris Zhang)
- drm/amdgpu: Use active umc info from discovery (Lijo Lazar)
- drm/amd/display: Populate register address for dentist for dcn401 (Dillon Varone)
- drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It (Austin Zheng)
- drm/amd/display: Increase block_sequence array size (Joshua Aberback) [Orabug: 38095164] {CVE-2025-38080}
- drm/amd/display: Initial psr_version with correct setting (Tom Chung)
- drm/amd/display: Update CR AUX RD interval interpretation (George Shen)
- Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY" (Brandon Syu)
- drm/amd/display: Support multiple options during psr entry. (Martin Tsai)
- drm/amd/pm: Skip P2S load for SMU v13.0.12 (Asad Kamal)
- drm/amdgpu: reset psp-&gt;cmd to NULL after releasing the buffer (Jiang Liu)
- drm/amd/display: Don't try AUX transactions on disconnected link (Ilya Bakoulin)
- drm/amd/display: pass calculated dram_speed_mts to dml2 (Charlene Liu)
- drm/amdgpu: Set snoop bit for SDMA for MI series (Harish Kasiviswanathan)
- drm/amdkfd: fix missing L2 cache info in topology (Eric Huang)
- drm/amdgpu/mes11: fix set_hw_resources_1 calculation (Alex Deucher)
- net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size (Huacai Chen)
- soundwire: cadence_master: set frame shape and divider based on actual clk freq (Bard Liao)
- soundwire: amd: change the soundwire wake enable/disable sequence (Vijendar Mukunda)
- phy: exynos5-usbdrd: fix EDS distribution tuning (gs101) (André Draszik)
- phy: core: don't require set_mode() callback for phy_get_mode() to work (Dmitry Baryshkov)
- phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF (Damon Ding)
- pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down (Claudiu Beznea)
- serial: sh-sci: Update the suspend/resume support (Claudiu Beznea)
- sched: Reduce the default slice to avoid tasks getting an extra tick (Zihan Zhou)
- x86/traps: Cleanup and robustify decode_bug() (Peter Zijlstra)
- x86/ibt: Handle FineIBT in handle_cfi_failure() (Peter Zijlstra)
- drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set (Shuicheng Lin)
- drm/xe/debugfs: fixed the return value of wedged_mode_set (Xin Wang)
- clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate (Krzysztof Kozlowski)
- clk: qcom: ipq5018: allow it to be bulid on arm32 (Karl Chan)
- drm/xe: Fix xe_tile_init_noalloc() error propagation (Lucas De Marchi)
- drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init() (Lucas De Marchi)
- net/mlx4_core: Avoid impossible mlx4_db_alloc() order value (Kees Cook)
- media: v4l: Memset argument to 0 before calling get_mbus_config pad op (Sakari Ailus)
- media: i2c: imx219: Correct the minimum vblanking value (David Plowman)
- kunit: tool: Use qboot on QEMU x86_64 (Brendan Jackman)
- smack: Revert "smackfs: Added check catlen" (Konstantin Andreev)
- smack: recognize ipv4 CIPSO w/o categories (Konstantin Andreev)
- pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map (Valentin Caron)
- ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() (Kuninori Morimoto)
- ASoC: tas2764: Power up/down amp on mute ops (Hector Martin)
- ASoC: tas2764: Mark SW_RESET as volatile (Hector Martin)
- ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG (Hector Martin)
- ASoC: ops: Enforce platform maximum on initial value (Martin Povišer)
- firmware: xilinx: Dont send linux address to get fpga config get status (Siva Durga Prasad Paladugu)
- firmware: arm_ffa: Handle the presence of host partition in the partition info (Sudeep Holla)
- firmware: arm_ffa: Reject higher major version as incompatible (Sudeep Holla)
- net/mlx5: Apply rate-limiting to high temperature warning (Shahar Shitrit)
- net/mlx5: Modify LSB bitmask in temperature event to include only the first bit (Shahar Shitrit)
- media: test-drivers: vivid: don't call schedule in loop (Hans Verkuil)
- irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base (Andrew Jones)
- hrtimers: Replace hrtimer_clock_to_base_table with switch-case (Andy Shevchenko)
- vxlan: Join / leave MC group after remote changes (Petr Machata)
- ACPI: HED: Always initialize before evged (Xiaofei Tan)
- PCI: Fix old_size lower bound in calculate_iosize() too (Ilpo Järvinen)
- eth: mlx4: don't try to complete XDP frames in netpoll (Jakub Kicinski)
- bpf: copy_verifier_state() should copy 'loop_entry' field (Eduard Zingerman) [Orabug: 38095018] {CVE-2025-38060}
- bpf: don't do clean_live_states when state-&gt;loop_entry-&gt;branches &gt; 0 (Eduard Zingerman)
- can: c_can: Use of_property_present() to test existence of DT property (Krzysztof Kozlowski)
- pmdomain: imx: gpcv2: use proper helper for property detection (Ahmad Fatoum)
- RDMA/core: Fix best page size finding when it can cross SG entries (Michael Margolin)
- serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (Alexis Lothoré) [Orabug: 38094901] {CVE-2025-38040}
- drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink (Harry Wentland)
- Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP" (Leo Zeng)
- drm/amd/display: Read LTTPR ALPM caps during link cap retrieval (George Shen)
- drm/amd/display: Fix BT2020 YCbCr limited/full range input (Ilya Bakoulin)
- drm/amd/display: Guard against setting dispclk low when active (Nicholas Kazlauskas)
- drm/amd/display: Add support for disconnected eDP streams (Harry Vanzylldejong)
- drm/amd/pm: Fetch current power limit from PMFW (Lijo Lazar)
- irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector (Anup Patel)
- eeprom: ee1004: Check chip before probing (Eddie James)
- mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs (Chris Morgan)
- i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA) (Frank Li)
- EDAC/ie31200: work around false positive build warning (Arnd Bergmann)
- power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree (Chris Morgan)
- net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [Orabug: 38095024] {CVE-2025-38061}
- wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU (Kuan-Chung Chen)
- wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware (Ping-Ke Shih)
- wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32() (Ping-Ke Shih)
- wifi: rtw89: fw: propagate error code from rtw89_h2c_tx() (Ping-Ke Shih)
- wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU (Bitterblue Smith)
- PCI: epf-mhi: Update device ID for SA8775P (Mrinmay Sarkar)
- clocksource: mips-gic-timer: Enable counter when CPUs start (Paul Burton)
- MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core (Paul Burton)
- genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (Jason Gunthorpe) [Orabug: 38095031] {CVE-2025-38062}
- x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op() (Uros Bizjak)
- drm/amdgpu: remove all KFD fences from the BO on release (Christian König)
- MIPS: Use arch specific syscall name match function (Bibo Mao)
- drm/xe/oa: Ensure that polled read returns latest data (Umesh Nerlige Ramappa)
- net: ipv6: Init tunnel link-netns before registering dev (Xiao Liang)
- crypto: skcipher - Zap type in crypto_alloc_sync_skcipher (Herbert Xu)
- crypto: ahash - Set default reqsize from ahash_alg (Herbert Xu)
- x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh)
- net/mlx5: Change POOL_NEXT_SIZE define value and make it global (Patrisious Haddad)
- scsi: scsi_debug: First fixes for tapes (Kai Mäkisara)
- dm: fix unconditional IO throttle caused by REQ_PREFLUSH (Jinliang Zheng) [Orabug: 38095038] {CVE-2025-38063}
- libbpf: Fix out-of-bound read (Nandakumar Edamana)
- loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize (Christoph Hellwig)
- net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode (Jianbo Liu)
- media: tc358746: improve calculation of the D-PHY timing registers (Matthias Fend)
- media: adv7180: Disable test-pattern control on adv7180 (Niklas Söderlund)
- cpuidle: menu: Avoid discarding useful information (Rafael J. Wysocki)
- vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines (Konstantin Shkolnyy)
- x86/nmi: Add an emergency handler in nmi_desc &amp; use it in nmi_shootdown_cpus() (Waiman Long)
- ASoC: mediatek: mt8188: Add reference for dmic clocks (Nícolas F R A Prado)
- ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile (Nícolas F R A Prado)
- drm/amd/display: Fix mismatch type comparison (Navid Assadian)
- drm/amd/display: fix dcn4x init failed (Charlene Liu)
- drm/amd/display: handle max_downscale_src_width fail check (Yihan Zhu)
- x86/build: Fix broken copy command in genimage.sh when making isoimage (Nir Lichtman)
- Octeontx2-af: RPM: Register driver with PCI subsys IDs (Hariprasad Kelam)
- bpf: Search and add kfuncs in struct_ops prologue and epilogue (Amery Hung)
- soc: ti: k3-socinfo: Do not use syscon helper to build regmap (Andrew Davis)
- wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band (Ramasamy Kaliappan)
- bonding: report duplicate MAC address in all situations (Hangbin Liu)
- net: xgene-v2: remove incorrect ACPI_PTR annotation (Arnd Bergmann)
- net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only (Eric Woudstra)
- leds: pwm-multicolor: Add check for fwnode_property_read_u32 (Yuanjun Gong)
- drm/xe: xe_gen_wa_oob: replace program_invocation_short_name (Daniel Gomez)
- drm/amdkfd: KFD release_work possible circular locking (Philip Yang)
- pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf (Inochi Amaoto)
- selftests/net: have `gro.sh -t` return a correct exit code (Kevin Krakauer)
- net/mlx5: Avoid report two health errors on same syndrome (Moshe Shemesh)
- drm/xe/pf: Create a link between PF and VF devices (K V P Satyanarayana)
- drm/xe/vf: Retry sending MMIO request to GUC on timeout error (K V P Satyanarayana)
- firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar) [Orabug: 38094925] {CVE-2025-38043}
- PCI: brcmstb: Add a softdep to MIP MSI-X driver (Stanimir Varbanov)
- PCI: brcmstb: Expand inbound window size up to 64GB (Stanimir Varbanov)
- wifi: ath12k: Report proper tx completion status to mac80211 (Vinith Kumar R)
- soc: apple: rtkit: Implement OSLog buffers properly (Hector Martin)
- soc: apple: rtkit: Use high prio work queue (Janne Grunau)
- perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters (Rob Herring)
- fpga: altera-cvp: Increase credit timeout (Kuhanh Murugasen Krishnan)
- drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence (AngeloGioacchino Del Regno)
- ARM: at91: pm: fix at91_suspend_finish for ZQ calibration (Li Bin)
- hwmon: (gpio-fan) Add missing mutex locks (Alexander Stein)
- x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Breno Leitao)
- clk: imx8mp: inform CCF of maximum frequency of clocks (Ahmad Fatoum)
- media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value (Ricardo Ribalda)
- media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map (Ricardo Ribalda)
- ublk: complete command synchronously on error (Caleb Sander)
- block: mark bounce buffering as incompatible with integrity (Christoph Hellwig)
- drm/rockchip: vop2: Add uv swap for cluster window (Andy Yan)
- ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). (Kuniyuki Iwashima)
- scsi: logging: Fix scsi_logging_level bounds (Nicolas Bouchinet)
- ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7 (Maciej S. Szmigiero)
- perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (Saket Kumar Bhaskar)
- net: pktgen: fix mpls maximum labels list parsing (Peter Seiderer)
- media: imx335: Set vblank immediately (Paul Elder)
- iommufd: Disallow allocating nested parent domain with fault ID (Yi Liu)
- ublk: enforce ublks_max only for unprivileged devices (Uday Shankar)
- dpll: Add an assertion to check freq_supported_num (Jiasheng Jiang)
- net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104 (Andrei Botila)
- net: ethernet: ti: cpsw_new: populate netdev of_node (Alexander Sverdlin)
- rcu: Fix get_state_synchronize_rcu_full() GP-start detection (Paul E. McKenney)
- pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" (Artur Weber)
- media: cx231xx: set device_caps for 417 (Hans Verkuil) [Orabug: 38094934] {CVE-2025-38044}
- perf/core: Clean up perf_try_init_event() (Peter Zijlstra)
- drm/amd/display: Request HW cursor on DCN3.2 with SubVP (Aric Cyr)
- drm/amd/display: Fix p-state type when p-state is unsupported (Dillon Varone)
- drm/amd/display: Fix DMUB reset sequence for DCN401 (Dillon Varone)
- drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination (George Shen)
- drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35 (Nicholas Kazlauskas)
- drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c (Victor Lu)
- remoteproc: qcom_wcnss: Handle platforms with only single power domain (Matti Lehtimäki)
- blk-throttle: don't take carryover for prioritized processing of metadata (Ming Lei)
- net: phylink: use pl-&gt;link_interface in phylink_expects_phy() (Choong Yong Liang)
- drm/gem: Test for imported GEM buffers with helper (Thomas Zimmermann)
- orangefs: Do not truncate file size (Matthew Wilcox) [Orabug: 38095056] {CVE-2025-38065}
- soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables (AngeloGioacchino Del Regno)
- dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [Orabug: 38095063] {CVE-2025-38066}
- usb: xhci: set page size to the xHCI-supported size (Niklas Neronin)
- media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() (Markus Elfring)
- ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 (Svyatoslav Ryhel)
- soc: samsung: include linux/array_size.h where needed (Arnd Bergmann)
- drm/xe: Retry BO allocation (Matthew Brost)
- drm/xe: Nuke VM's mapping upon close (Matthew Brost)
- ieee802154: ca8210: Use proper setters and getters for bitwise types (Andy Shevchenko)
- rtc: ds1307: stop disabling alarms on probe (Alexandre Belloni)
- tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() (Eric Dumazet)
- ALSA: seq: Improve data consistency at polling (Takashi Iwai)
- powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 (Andreas Schwab)
- arm64: tegra: Resize aperture for the IGX PCIe C5 slot (Jonathan Hunter)
- arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator (Diogo Ivo)
- drm/amdgpu: Fix missing drain retry fault the last entry (Emily Deng)
- drm/amdkfd: Set per-process flags only once cik/vi (Harish Kasiviswanathan)
- drm/amdkfd: Set per-process flags only once for gfx9/10/11/12 (Harish Kasiviswanathan)
- crypto: mxs-dcp - Only set OTP_KEY bit for OTP key (Sven Schwermer)
- crypto: lzo - Fix compression buffer overrun (Herbert Xu) [Orabug: 38095079] {CVE-2025-38068}
- misc: pci_endpoint_test: Give disabled BARs a distinct error code (Niklas Cassel)
- PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops (Christian Bruel) [Orabug: 38095087] {CVE-2025-38069}
- watchdog: aspeed: Update bootstatus handling (Chin-Ting Kuo)
- cpufreq: tegra186: Share policy per cluster (Aaron Kling)
- iommu/amd/pgtbl_v2: Improve error handling (Vasant Hegde)
- coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t (Levi Yun)
- badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable &lt; 0 (Coly Li)
- ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup() (Alexey Klimov)
- auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" (Andy Shevchenko)
- gfs2: Check for empty queue in run_queue (Andreas Gruenbacher)
- drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch (Leon Huang)
- drm/amd/display: not abort link train when bw is low (Peichen Huang)
- drm/amd/display: calculate the remain segments for all pipes (Zhikai Zhai)
- drm/amd/display: remove minimum Dispclk and apply oem panel timing. (Charlene Liu)
- ipv6: save dontfrag in cork (Willem de Bruijn)
- wifi: cfg80211: allow IR in 20 MHz configurations (Anjaneyulu)
- wifi: mac80211_hwsim: Fix MLD address translation (Ilan Peer)
- wifi: mac80211: fix warning on disconnect during failed ML reconf (Johannes Berg)
- wifi: iwlwifi: fix the ECKV UEFI variable name (Emmanuel Grumbach)
- wifi: iwlwifi: mark Br device not integrated (Johannes Berg)
- wifi: iwlwifi: fix debug actions order (Johannes Berg) [Orabug: 38094942] {CVE-2025-38045}
- wifi: iwlwifi: w/a FW SMPS mode selection (Daniel Gabay)
- wifi: iwlwifi: don't warn when if there is a FW error (Miri Korenblit)
- printk: Check CON_SUSPEND when unblanking a console (Marcos Paulo de Souza)
- iommu: Keep dev-&gt;iommu state consistent (Robin Murphy)
- hwmon: (dell-smm) Increment the number of fans (Kurt Borja)
- wifi: iwlwifi: mvm: fix setting the TK when associated (Avraham Stern)
- usb: xhci: Don't change the status of stalled TDs on failed Stop EP (Michał Pecio)
- mmc: sdhci: Disable SD card clock before changing parameters (Erick Shepherd)
- mmc: dw_mmc: add exynos7870 DW MMC support (Kaustabh Chakraborty)
- arm64/mm: Check PUD_TYPE_TABLE in pud_bad() (Ryan Roberts)
- arm64/mm: Check pmd_table() in pmd_trans_huge() (Ryan Roberts)
- phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set (Andy Yan)
- PNP: Expand length of fixup id string (Kees Cook)
- netfilter: conntrack: Bound nf_conntrack sysctl writes (Nicolas Bouchinet)
- wifi: rtw89: set force HE TB mode when connecting to 11ax AP (Dian-Syuan Yang)
- timer_list: Don't use %pK through printk() (Thomas Weißschuh)
- net: hsr: Fix PRP duplicate detection (Jaakko Karrenpalo)
- net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe (Jonas Karlman)
- posix-timers: Ensure that timer initialization is fully visible (Thomas Gleixner)
- posix-timers: Add cond_resched() to posix_timer_add() search loop (Eric Dumazet)
- RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() (Maher Sanalla)
- ext4: do not convert the unwritten extents if data writeback fails (Baokun Li)
- ext4: reject the 'data_err=abort' option in nojournal mode (Baokun Li)
- clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490 (Taniya Das)
- ASoC: sun4i-codec: support hp-det-gpios property (Ryan Walklin)
- drm/amdgpu: Update SRIOV video codec caps (David Rosca)
- drm/amdgpu/gfx11: don't read registers in mqd init (Alex Deucher)
- drm/amdgpu/gfx12: don't read registers in mqd init (Alex Deucher)
- mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check (Shree Ramamoorthy)
- pinctrl-tegra: Restore SFSEL bit when freeing pins (Prathamesh Shete)
- xen: Add support for XenServer 6.1 platform device (Frediano Ziglio)
- net/smc: use the correct ndev to find pnetid by pnetid table (Guangguan Wang)
- dm: restrict dm device size to 2^63-512 bytes (Mikulas Patocka)
- crypto: octeontx2 - suppress auth failure screaming due to negative tests (Shashank Gupta)
- kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf (Masahiro Yamada)
- kbuild: fix argument parsing in scripts/config (Seyediman Seyedarab)
- bpf: Allow pre-ordering for bpf cgroup progs (Yonghong Song)
- ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect (Nícolas F R A Prado)
- ASoC: pcm6240: Drop bogus code handling IRQ as GPIO (Linus Walleij)
- spi: spi-mux: Fix coverity issue, unchecked return value (Sergio Perez Gonzalez)
- erofs: initialize decompression early (Gao Xiang)
- thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer (Mika Westerberg)
- objtool: Fix error handling inconsistencies in check() (Josh Poimboeuf)
- rtc: rv3032: fix EERD location (Alexandre Belloni)
- tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() (Ilpo Järvinen)
- jbd2: do not try to recover wiped journal (Jan Kara)
- PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off() (Frank Li)
- bpf: Return prog btf_id without capable check (Mykyta Yatsenko)
- vfio/pci: Handle INTx IRQ_NOTCONNECTED (Alex Williamson)
- scsi: st: ERASE does not change tape location (Kai Mäkisara)
- scsi: st: Tighten the page format heuristics with MODE SELECT (Kai Mäkisara)
- hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure (Al Viro)
- ext4: reorder capability check last (Christian Göttsche)
- riscv: Call secondary mmu notifier when flushing the tlb (Alexandre Ghiti)
- bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set (Shantiprasad Shettar)
- wifi: mwifiex: Fix HT40 bandwidth issue. (Jeff Chen)
- um: Update min_low_pfn to match changes in uml_reserved (Tiwei Bie)
- um: Store full CSGSFS and SS register from mcontext (Benjamin Berg)
- clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug (Nick Hu)
- dlm: make tcp still work in multi-link env (Heming Zhao)
- s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste() (Heiko Carstens)
- i3c: master: svc: Fix missing STOP for master request (Stanley Chu)
- drm/amdgpu: adjust drm_firmware_drivers_only() handling (Alex Deucher)
- drm/amd/display: Guard against setting dispclk low for dcn31x (Jing Zhou)
- drm/amdgpu: release xcp_mgr on exit (Flora Cui)
- blk-cgroup: improve policy registration error handling (Chen Linxuan)
- btrfs: send: return -ENAMETOOLONG when attempting a path that is too long (Filipe Manana)
- btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work() (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to async workers (Filipe Manana)
- btrfs: run btrfs_error_commit_super() early (Qu Wenruo)
- btrfs: avoid linker error in btrfs_find_create_tree_block() (Mark Harmstone)
- btrfs: make btrfs_discard_workfn() block_group ref explicit (Boris Burkov)
- i2c: pxa: fix call balance of i2c-&gt;clk handling routines (Vitalii Mordan)
- i2c: qup: Vote for interconnect bandwidth to DRAM (Stephan Gerhold)
- x86/mm: Check return value from memblock_phys_alloc_range() (Philip Redkin) [Orabug: 38095101] {CVE-2025-38071}
- x86/microcode: Update the Intel processor flag scan check (Sohil Mehta)
- x86/smpboot: Fix INIT delay assignment for extended Intel Families (Sohil Mehta)
- x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP (Ingo Molnar)
- x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers (Thomas Huth)
- wifi: mt76: mt7925: fix fails to enter low power mode in suspend state (Quan Zhou)
- wifi: mt76: mt7925: load the appropriate CLC data based on hardware type (Ming Yen Hsieh)
- wifi: mt76: mt7996: revise TXS size (Benjamin Lin)
- wifi: mt76: mt7996: fix SER reset trigger on WED reset (Rex Lu)
- wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 (Felix Fietkau)
- cgroup/rstat: avoid disabling irqs for O(num_cpu) (Eric Dumazet)
- drm/amdgpu: Skip pcie_replay_count sysfs creation for VF (Victor Skvortsov)
- mmc: host: Wait for Vdd to settle on card power off (Erick Shepherd)
- staging: vchiq_arm: Create keep-alive thread during probe (Stefan Wahren)
- pidfs: improve multi-threaded exec and premature thread-group leader exit polling (Christian Brauner)
- libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [Orabug: 38095109] {CVE-2025-38072}
- ext4: on a remount, only log the ro or r/w state when it has changed (Nicolas Bretz)
- xen/pci: Do not register devices with segments &gt;= 0x10000 (Roger Pau Monné)
- PCI: vmd: Disable MSI remapping bypass under Xen (Roger Pau Monné)
- drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12 (Jonathan Kim)
- drm/amdgpu/discovery: check ip_discovery fw file available (Flora Cui)
- pNFS/flexfiles: Report ENETDOWN as a connection error (Trond Myklebust)
- tools/build: Don't pass test log files to linker (Ian Rogers)
- r8169: disable RTL8126 ZRX-DC timeout (Chunhao Lin)
- PCI: dwc: ep: Ensure proper iteration over outbound map windows (Frank Li)
- objtool: Properly disable uaccess validation (Josh Poimboeuf)
- lockdep: Fix wait context check on softirq for PREEMPT_RT (Ryo Takakura)
- dql: Fix dql-&gt;limit value when reset. (Jing Su)
- Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken (Pedro Nishiyama)
- Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal (Sean Wang)
- thermal/drivers/qoriq: Power down TMU on system suspend (Alice Guo)
- thermal/drivers/mediatek/lvts: Start sensor interrupts disabled (Nícolas F R A Prado)
- net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus (Hans-Frieder Vogt)
- net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards (Hans-Frieder Vogt)
- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (Daniel Hsu)
- ASoC: codecs: wsa883x: Correct VI sense channel mask (Krzysztof Kozlowski)
- ASoC: codecs: wsa884x: Correct VI sense channel mask (Krzysztof Kozlowski)
- spi-rockchip: Fix register out of bounds access (Luis de Arquer) [Orabug: 38095173] {CVE-2025-38081}
- SUNRPC: rpcbind should never reset the port to the value '0' (Trond Myklebust)
- SUNRPC: rpc_clnt_set_transport() must not change the autobind setting (Trond Myklebust)
- NFSv4: Treat ENETUNREACH errors as fatal for state recovery (Trond Myklebust)
- cifs: Fix establishing NetBIOS session for SMB2+ connection (Pali Rohár)
- cifs: add validation check for the fields in smb_aces (Namjae Jeon)
- cifs: Set default Netbios RFC1001 server name to hostname in UNC (Pali Rohár)
- fbdev: core: tileblit: Implement missing margin clearing for tileblit (Zsolt Kajtar)
- fbcon: Use correct erase colour for clearing in fbcon (Zsolt Kajtar)
- fbdev: fsl-diu-fb: add missing device_remove_file() (Shixiong Ou)
- riscv: Allow NOMMU kernels to access all of RAM (Samuel Holland)
- mailbox: use error ret code of of_parse_phandle_with_args() (Tudor Ambarus)
- mailbox: pcc: Use acpi_os_ioremap() instead of ioremap() (Sudeep Holla)
- tpm: Convert warn to dbg in tpm2_start_auth_session() (Jonathan Mcdowell)
- ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list (Diogo Ivo)
- tracing: Mark binary printing functions with __printf() attribute (Andy Shevchenko)
- iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability (Yi Liu)
- arm64: Add support for HIP09 Spectre-BHB mitigation (Jinqian Yang)
- SUNRPC: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFS: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Trond Myklebust)
- io_uring/msg: initialise msg request opcode (Pavel Begunkov)
- exfat: call bh_read in get_block only when necessary (Sungjong Seo)
- fuse: Return EPERM rather than ENOSYS from link() (Matt Johnston)
- smb: client: Store original IO parameters and prevent zero IO sizes (Zhaolong Wang)
- cifs: Fix negotiate retry functionality (Pali Rohár)
- cifs: Fix querying and creating MF symlinks over SMB1 (Pali Rohár)
- cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES (Pali Rohár)
- s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log (Tony Krowiak)
- x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li) [Orabug: 38094951] {CVE-2025-38047}
- kconfig: merge_config: use an empty file as initfile (Daniel Gomez)
- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (Haoran Jiang)
- bpf: fix possible endless loop in BPF map iteration (Brandon Kammerdiener)
- io_uring: don't duplicate flushing in io_req_post_cqe (Pavel Begunkov)
- block: fix race between set_blocksize and read paths (Darrick J. Wong) [Orabug: 38095117] {CVE-2025-38073}
- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (Ihor Solodrai)
- drm/amdgpu: Allow P2P access through XGMI (Felix Kuehling)
- drm/amd/display: Enable urgent latency adjustment on DCN35 (Nicholas Susanto)
- fs/ext4: use sleeping version of sb_find_get_block() (Davidlohr Bueso)
- fs/jbd2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/ocfs2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: introduce sleeping flavors for pagecache lookups (Davidlohr Bueso)
- fs/buffer: split locking for pagecache lookups (Davidlohr Bueso)
- ima: process_measurement() needlessly takes inode_lock() on MAY_READ (Frederick Lawler)
- dma-mapping: Fix warning reported for missing prototype (Balbir Singh)
- net: enetc: refactor bulk flipping of RX buffers to separate function (Vladimir Oltean)
- vhost_task: fix vhost_task_create() documentation (Stefano Garzarella)
- cgroup: Fix compilation issue due to cgroup_mutex not being exported (Gao Xu)
- dma-mapping: avoid potential unused data compilation warning (Marek Szyprowski)
- mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type (Hans de Goede)
- intel_th: avoid using deprecated page-&gt;mapping, index fields (Lorenzo Stoakes)
- dma/mapping.c: dev_dbg support for dma_addressing_limited (Balbir Singh)
- virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han) [Orabug: 38094958] {CVE-2025-38048}
- scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices (Manish Pandey)
- scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [Orabug: 38095134] {CVE-2025-38075}
- nvmem: qfprom: switch to 4-byte aligned reads (Dmitry Baryshkov)
- nvmem: core: update raw_len if the bit reading is required (Dmitry Baryshkov)
- nvmem: core: verify cell's raw_len (Dmitry Baryshkov)
- nvmem: core: fix bit offsets of more than one byte (Dmitry Baryshkov)
- nvmem: rockchip-otp: add rk3576 variant data (Heiko Stuebner)
- nvmem: rockchip-otp: Move read-offset into variant-data (Heiko Stuebner)
- cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist (Pengyu Luo)
- phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Move IRQ request in probe (Claudiu Beznea)
- i2c: designware: Fix an error handling path in i2c_dw_pci_probe() (Christophe Jaillet)
- i2c: designware: Use temporary variable for struct device (Andy Shevchenko)
- drm/amd/display: Defer BW-optimization-blocked DRR adjustments (John Olender)
- drm/amd/display: Correct timing_adjust_pending flag setting. (Zhongwei)
- drm/amd/display: Do not enable replay when vtotal update is pending. (Sung-Huai Wang)
- drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401 (Dillon Varone)
- LTS version: v6.12.30 (Jack Vogel)
- drm/amdgpu: fix pm notifier handling (Alex Deucher)
- phy: tegra: xusb: remove a stray unlock (Dan Carpenter)
- usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977018] {CVE-2025-37967}
- drm/tiny: panel-mipi-dbi: Use drm_client_setup_with_fourcc() (Fabio Estevam)
- drm/panel-mipi-dbi: Run DRM default client setup (Thomas Zimmermann)
- drm/fbdev-dma: Support struct drm_driver.fbdev_probe (Thomas Zimmermann)
- Bluetooth: btnxpuart: Fix kernel panic during FW release (Neeraj Sanjay Kale) [Orabug: 37844459] {CVE-2025-22102}
- iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977026] {CVE-2025-37968}
- accel/ivpu: Fix fw log printing (Jacek Lawrynowicz)
- accel/ivpu: Refactor functions in ivpu_fw_log.c (Jacek Lawrynowicz)
- accel/ivpu: Reset fw log on cold boot (Tomasz Rusinowicz)
- accel/ivpu: Rename ivpu_log_level to fw_log_level (Jacek Lawrynowicz)
- mm/page_alloc: fix race condition in unaccepted memory handling (Kirill A. Shutemov) [Orabug: 38094767] {CVE-2025-38008}
- drm/xe/gsc: do not flush the GSC worker from the reset path (Daniele Ceraolo Spurio)
- CIFS: New mount option for cifs.upcall namespace resolution (Ritvik Budhiraja)
- dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (Shuai Xue) [Orabug: 38094790] {CVE-2025-38014}
- dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094793] {CVE-2025-38015}
- dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call (Shuai Xue)
- dmaengine: idxd: Add missing cleanups in cleanup internals (Shuai Xue)
- dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs (Shuai Xue)
- dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy (Yemike Abhilash Chandra)
- dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094756] {CVE-2025-38005}
- mm: userfaultfd: correct dirty flags set for both present and swap pte (Barry Song)
- net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
- ring-buffer: Fix persistent buffer when commit page is the reader page (Steven Rostedt)
- wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094770] {CVE-2025-38009}
- tpm: Mask TPM RC in tpm2_start_auth_session() (Jarkko Sakkinen)
- spi: tegra114: Use value to check for invalid delays (Aaron Kling)
- smb: client: fix memory leak during error handling for POSIX mkdir (Jethro Donaldson)
- scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer (Steve Siwinski)
- phy: renesas: rcar-gen3-usb2: Set timing registers only once (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind (Claudiu Beznea)
- phy: Fix error handling in tegra_xusb_port_init (Ma Ke)
- phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking (Wayne Chang) [Orabug: 38094777] {CVE-2025-38010}
- tracing: samples: Initialize trace_array_printk() with the correct function (Steven Rostedt)
- ftrace: Fix preemption accounting for stacktrace filter command (Donglin Peng)
- ftrace: Fix preemption accounting for stacktrace trigger command (Donglin Peng)
- kbuild: Disable -Wdefault-const-init-unsafe (Nathan Chancellor)
- Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer() (Michael Kelley)
- Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (Michael Kelley)
- arm64: dts: rockchip: Remove overdrive-mode OPPs from RK3588J SoC dtsi (Dragan Simic)
- arm64: dts: amlogic: dreambox: fix missing clkc_audio node (Christian Hewitt)
- hv_netvsc: Remove rmsg_pgcnt (Michael Kelley)
- hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (Michael Kelley)
- hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (Michael Kelley)
- dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi)
- ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera (Nicolas Chauvet)
- ALSA: usb-audio: Add sample rate quirk for Audioengine D1 (Christian Heusel)
- ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() (Xu Wang)
- ACPI: PPTT: Fix processor subtable walk (Jeremy Linton)
- gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
- MAINTAINERS: Update Alexey Makhalov's email address (Alexey Makhalov)
- drm/amd/display: Avoid flooding unnecessary info messages (Wayne Lin)
- drm/amd/display: Correct the reply value when AUX write incomplete (Wayne Lin)
- drm/amdgpu: csa unmap use uninterruptible lock (Philip Yang) [Orabug: 38094779] {CVE-2025-38011}
- drm/amdgpu: fix incorrect MALL size for GFX1151 (Tim Huang)
- Revert "drm/amd/display: Hardware cursor changes color when switched to software cursor" (Melissa Wen)
- btrfs: add back warning for mount option commit values exceeding 300 (Kyoji Ogasawara)
- btrfs: fix folio leak in submit_one_async_extent() (Boris Burkov)
- btrfs: fix discard worker infinite loop after disabling discard (Filipe Manana)
- LoongArch: uprobes: Remove redundant code about resume_era (Tiezhu Yang)
- LoongArch: uprobes: Remove user_{en,dis}able_single_step() (Tiezhu Yang)
- LoongArch: Fix MAX_REG_OFFSET calculation (Huacai Chen)
- LoongArch: Save and restore CSR.CNTC for hibernation (Huacai Chen)
- LoongArch: Move __arch_cpu_idle() to .cpuidle.text section (Huacai Chen)
- LoongArch: Prevent cond_resched() occurring within kernel-fpu (Tianyang Zhang)
- HID: bpf: abort dispatch if device destroyed (Rongrong) [Orabug: 38094796] {CVE-2025-38016}
- udf: Make sure i_lenExtents is uptodate on inode eviction (Jan Kara)
- sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator (Tejun Heo) [Orabug: 38094786] {CVE-2025-38012}
- dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" (Nathan Lynch)
- NFSv4/pnfs: Reset the layout state after a layoutreturn (Trond Myklebust)
- tsnep: fix timestamping with a stacked DSA driver (Gerhard Engleder)
- net/tls: fix kernel panic when alloc_page failed (Pengtao He) [Orabug: 38094802] {CVE-2025-38018}
- mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (Ido Schimmel) [Orabug: 38094804] {CVE-2025-38019}
- wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request (Kees Cook) [Orabug: 38094788] {CVE-2025-38013}
- octeontx2-pf: Do not reallocate all ntuple filters (Subbaraya Sundeep)
- octeontx2-af: Fix CGX Receive counters (Hariprasad Kelam)
- net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability (Bc-Bocun Chen)
- octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy (Subbaraya Sundeep)
- netlink: specs: tc: all actions are indexed arrays (Jakub Kicinski)
- netlink: specs: tc: fix a couple of attribute names (Jakub Kicinski)
- drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value (Umesh Nerlige Ramappa)
- regulator: max20086: fix invalid memory access (Cosmin Tanislav) [Orabug: 38094833] {CVE-2025-38027}
- qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() (Abdun Nihaal)
- net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094808] {CVE-2025-38020}
- vsock/test: Fix occasional failure in SIOCOUTQ tests (Konstantin Shkolnyy)
- net: dsa: b53: prevent standalone from trying to forward to other ports (Jonas Gorski)
- ALSA: sh: SND_AICA should depend on SH_DMA_API (Geert Uytterhoeven)
- nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (Keith Busch)
- nvme-pci: make nvme_pci_npages_prp() __always_inline (Kees Cook)
- net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING (Vladimir Oltean)
- net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe)
- ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info (Takashi Iwai)
- ALSA: seq: Fix delivery of UMP events to group ports (Takashi Iwai)
- net: mctp: Ensure keys maintain only one ref to corresponding dev (Andrew Jeffery)
- tests/ncdevmem: Fix double-free of queue array (Cosmin Ratiu)
- selftests: ncdevmem: Switch to AF_INET6 (Stanislav Fomichev)
- selftests: ncdevmem: Make client_ip optional (Stanislav Fomichev)
- selftests: ncdevmem: Unify error handling (Stanislav Fomichev)
- selftests: ncdevmem: Separate out dmabuf provider (Stanislav Fomichev)
- selftests: ncdevmem: Redirect all non-payload output to stderr (Stanislav Fomichev)
- net: mctp: Don't access ifa_index when missing (Matt Johnston)
- mctp: no longer rely on net-&gt;dev_index_head[] (Eric Dumazet)
- tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing (Hangbin Liu)
- net_sched: Flush gso_skb list too during -&gt;change() (Cong Wang) [Orabug: 37998128] {CVE-2025-37992}
- Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags (Luiz Augusto von Dentz)
- RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Zhu Yanjun) [Orabug: 38094813] {CVE-2025-38022}
- spi: loopback-test: Do not split 1024-byte hexdumps (Geert Uytterhoeven)
- nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094818] {CVE-2025-38023}
- HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 38094764] {CVE-2025-38007}
- HID: thrustmaster: fix memory leak in thrustmaster_interrupts() (Qasim Ijaz)
- RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094827] {CVE-2025-38024}
- virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx (Koichiro Den)
- virtio_ring: add a func argument 'recycle_done' to virtqueue_reset() (Koichiro Den)
- iio: chemical: sps30: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7768-1: Fix insufficient alignment of timestamp. (Jonathan Cameron)
- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
- xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
- Revert "drm/amd: Stop evicting resources on APUs in suspend" (Alex Deucher)
- drm/amd: Add Suspend/Hibernate notification callback support (Mario Limonciello)
- iio: pressure: mprls0025pa: use aligned_s64 for timestamp (David Lechner)
- iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7266: Fix potential timestamp alignment issue. (Jonathan Cameron)
- KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (Sean Christopherson)
- KVM: Add member to struct kvm_gfn_range to indicate private/shared (Isaku Yamahata)
- uio_hv_generic: Fix sysfs creation path for ring buffer (Naman Jain)
- tpm: tis: Double the timeout B to 4s (Michal Suchanek)
- tracing: probes: Fix a possible race in trace_probe_log APIs (Masami Hiramatsu)
- cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks (Waiman Long)
- arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout (Himanshu Bhavani)
- platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection (Hans de Goede)
- platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL) (Runhua He)
- binfmt_elf: Move brk for static PIE even if ASLR disabled (Kees Cook)
- riscv: dts: sophgo: fix DMA data-width configuration for CV18xx (Ze Huang)
- drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies (Mario Limonciello)
- drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC Policies (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list to always include security.* xattrs (Stephen Smalley)
- arm64: dts: rockchip: Assign RT5616 MCLK rate on rk3588-friendlyelec-cm3588 (Tom Vincent)
- LTS version: v6.12.29 (Jack Vogel)
- arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977004] {CVE-2025-37963}
- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976926] {CVE-2025-37948}
- arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
- arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
- arm64: insn: Add support for encoding DSB (James Morse)
- mm: page_alloc: speed up fallbacks in rmqueue_bulk() (Johannes Weiner)
- mm: page_alloc: don't steal single pages from biggest buddy (Johannes Weiner)
- Bluetooth: btmtk: Remove the resetting step before downloading the fw (Hao Qin)
- Bluetooth: btmtk: Remove resetting mt7921 before downloading the fw (Hao Qin)
- io_uring: always arm linked timeouts prior to issue (Jens Axboe)
- rust: clean Rust 1.88.0's `clippy::uninlined_format_args` lint (Miguel Ojeda)
- rust: allow Rust 1.87.0's `clippy::ptr_eq` lint (Miguel Ojeda)
- Revert "um: work around sched_yield not yielding in time-travel mode" (Christian Lamparter)
- do_umount(): add missing barrier before refcount checks in sync case (Al Viro)
- io_uring/sqpoll: Increase task_work submission batch size (Gabriel Krisman Bertazi)
- drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs (Tejas Upadhyay)
- drm/xe/tests/mocs: Update xe_force_wake_get() return handling (Himal Prasad Ghimiray)
- riscv: misaligned: enable IRQs while handling misaligned accesses (Clément Léger)
- riscv: misaligned: factorize trap handling (Clément Léger)
- nvme: unblock ctrl state transition for firmware update (Daniel Wagner)
- drm/panel: simple: Update timings for AUO G101EVN010 (Kevin Baker)
- loop: Add sanity check for read/write_iter (Lizhi Xu)
- loop: factor out a loop_assign_backing_file helper (Christoph Hellwig)
- loop: refactor queue limits updates (Christoph Hellwig)
- loop: Fix ABBA locking race (Ogawa Hirofumi)
- loop: Simplify discard granularity calc (John Garry)
- loop: Use bdev limit helpers for configuring discard (John Garry)
- riscv: misaligned: Add handling for ZCB instructions (Nylon Chen)
- MIPS: Fix MAX_REG_OFFSET (Thorsten Blum)
- iio: adc: dln2: Use aligned_s64 for timestamp (Jonathan Cameron)
- iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64 (Jonathan Cameron)
- types: Complement the aligned types with signed 64-bit one (Andy Shevchenko)
- iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer. (Jonathan Cameron)
- iio: accel: adxl367: fix setting odr for activity time update (Lothar Rubusch)
- usb: usbtmc: Fix erroneous generic_read ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous wait_srq ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous get_stb ioctl error returns (Dave Penkler)
- USB: usbtmc: use interruptible sleep in usbtmc_read (Oliver Neukum)
- usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015126] {CVE-2025-37994}
- usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition (Rd Babiera)
- usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs (Lukasz Czechowski)
- usb: host: tegra: Prevent host controller crash when OTG port is used (Jim Lin)
- usb: gadget: Use get_status callback to set remote wakeup capability (Prashanth K)
- usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN (Wayne Chang)
- usb: gadget: f_ecm: Add get_status callback (Prashanth K)
- usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version (Pawel Laszczak)
- usb: cdnsp: Fix issue with resuming from L1 (Pawel Laszczak)
- usb: dwc3: gadget: Make gadget_wakeup asynchronous (Prashanth K)
- x86/microcode: Consolidate the loader enablement checking (Borislav Petkov)
- module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015131] {CVE-2025-37995}
- memblock: Accept allocated memory before use in memblock_double_array() (Tom Lendacky) [Orabug: 37976994] {CVE-2025-37960}
- clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() (Sebastian Andrzej Siewior)
- arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong idmap generation (Levi Yun)
- accel/ivpu: Increase state dump msg timeout (Jacek Lawrynowicz)
- xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976934] {CVE-2025-37949}
- xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it (John Ernberg)
- smb: client: Avoid race in open_cached_dir with lease breaks (Paul Aurich) [Orabug: 37976959] {CVE-2025-37954}
- usb: uhci-platform: Make the clock really optional (Alexey Charkov)
- drm/amdgpu/hdp7: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amd/display: Copy AUX read reply data whenever length &gt; 0 (Wayne Lin)
- drm/amd/display: Fix wrong handling for AUX_DEFER case (Wayne Lin)
- drm/amd/display: Remove incorrect checking in dmub aux handler (Wayne Lin)
- drm/amd/display: Fix the checking condition in dmub aux handling (Wayne Lin)
- drm/amd/display: more liberal vmin/vmax update for freesync (Aurabindo Pillai)
- drm/amd/display: Fix invalid context error in dml helper (Roman Li) [Orabug: 37977185] {CVE-2025-37965}
- drm/amdgpu/vcn: using separate VCN1_AON_SOC offset (Ruijing Dong)
- drm/xe: Add page queue multiplier (Matthew Brost)
- drm/v3d: Add job to pending list if the reset was skipped (Maíra Canal) [Orabug: 37976942] {CVE-2025-37951}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug: 37977031] {CVE-2025-37969}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977037] {CVE-2025-37970}
- iio: imu: inv_mpu6050: align buffer for timestamp (David Lechner)
- iio: adis16201: Correct inclinometer channel resolution (Gabriel)
- iio: adc: rockchip: Fix clock initialization sequence (Simon Xue)
- iio: adc: ad7606: fix serial register access (Angelo Dureghello)
- io_uring: ensure deferred completions are flushed for multishot (Jens Axboe)
- drm/amd/display: Shift DMUB AUX reply command if necessary (Wayne Lin)
- KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (Mikhail Lobanov) [Orabug: 37976977] {CVE-2025-37957}
- selftests/mm: fix a build failure on powerpc (Nysal Jan K.A.)
- selftests/mm: compaction_test: support platform with huge mount of memory (Feng Tang)
- mm/userfaultfd: fix uninitialized output field for -EAGAIN race (Peter Xu)
- mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976982] {CVE-2025-37958}
- mm: fix folio_pte_batch() on XEN PV (Petr Vaněk)
- x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (Dave Hansen) [Orabug: 37977013] {CVE-2025-37964}
- staging: axis-fifo: Correct handling of tx_fifo_depth for size validation (Gabriel)
- staging: axis-fifo: Remove hardware resets for user errors (Gabriel)
- staging: bcm2835-camera: Initialise dev in v4l2_dev (Dave Stevenson) [Orabug: 37977042] {CVE-2025-37971}
- staging: iio: adc: ad7816: Correct conditional logic for store mode (Gabriel)
- rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.87.0 (Miguel Ojeda)
- rust: clean Rust 1.88.0's `unnecessary_transmutes` lint (Miguel Ojeda)
- Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 (Aditya Garg)
- Input: synaptics - enable SMBus for HP Elitebook 850 G1 (Dmitry Torokhov)
- Input: synaptics - enable InterTouch on Dell Precision M3800 (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30L-G (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30-D (Manuel Fombuena)
- Input: xpad - fix two controller table values (Vicki Pfau)
- Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller (Lode Willems)
- Input: xpad - fix Share button on Xbox One controllers (Vicki Pfau)
- Input: mtk-pmic-keys - fix possible null pointer dereference (Gary Bisson) [Orabug: 37977044] {CVE-2025-37972}
- Input: cyttsp5 - fix power control issue on wakeup (Mikael Gonella-Bolduc)
- Input: cyttsp5 - ensure minimum reset pulse width (Hugo Villeneuve)
- virtio-net: fix total qstat values (Jakub Kicinski)
- net: export a helper for adding up queue stats (Jakub Kicinski)
- fbnic: Do not allow mailbox to toggle to ready outside fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Pull fbnic_fw_xmit_cap_msg use out of interrupt context (Alexander Duyck)
- fbnic: Improve responsiveness of fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Actually flush_tx instead of stalling out (Alexander Duyck)
- fbnic: Gate AXI read/write enabling on FW mailbox (Alexander Duyck)
- fbnic: Fix initialization of mailbox descriptor rings (Alexander Duyck)
- net: dsa: b53: do not set learning and unicast/multicast on up (Jonas Gorski)
- net: dsa: b53: fix learning on VLAN unaware bridges (Jonas Gorski)
- net: dsa: b53: fix toggling vlan_filtering (Jonas Gorski)
- net: dsa: b53: do not program vlans when vlan filtering is off (Jonas Gorski)
- net: dsa: b53: do not allow to configure VLAN 0 (Jonas Gorski)
- net: dsa: b53: always rejoin default untagged VLAN on bridge leave (Jonas Gorski)
- net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave (Jonas Gorski)
- net: dsa: b53: fix flushing old pvid VLAN on pvid change (Jonas Gorski)
- net: dsa: b53: fix clearing PVID of a port (Jonas Gorski)
- net: dsa: b53: keep CPU port always tagged again (Jonas Gorski)
- net: dsa: b53: allow leaky reserved multicast (Jonas Gorski)
- bpf: Scrub packet on bpf_redirect_peer (Paul Chaignon) [Orabug: 37976990] {CVE-2025-37959}
- netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015141] {CVE-2025-37997}
- ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [Orabug: 37976996] {CVE-2025-37961}
- erofs: ensure the extra temporary copy is valid for shortened bvecs (Gao Xiang)
- ice: use DSN instead of PCI BDF for ice_adapter index (Przemek Kitszel)
- ice: Initial support for E825C hardware in ice_adapter (Sergey Temerkhanov)
- wifi: mac80211: fix the type of status_code for negotiated TID to Link Mapping (Michael-Cy Lee)
- can: gw: fix RCU/BH usage in cgw_create_job() (Oliver Hartkopp)
- can: mcp251xfd: fix TDC setting for low data bit rates (Kelsey Maes)
- can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe (Antonios Salios) [Orabug: 38015123] {CVE-2025-37993}
- net: ethernet: mtk_eth_soc: do not reset PSE when setting FE (Frank Wunderlich)
- net: ethernet: mtk_eth_soc: reset all TX queues on DMA free (Daniel Golle)
- gre: Fix again IPv6 link-local address generation. (Guillaume Nault)
- virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (Jakub Kicinski) [Orabug: 37976969] {CVE-2025-37955}
- virtio_net: xsk: bind/unbind xsk for tx (Xuan Zhuo)
- sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 37977176] {CVE-2025-37953}
- s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
- ksmbd: fix memory leak in parse_lease_state() (Zhaolong Wang) [Orabug: 37977180] {CVE-2025-37962}
- openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015148] {CVE-2025-37998}
- ksmbd: Fix UAF in __close_file_table_ids (Sean Heelan) [Orabug: 37976951] {CVE-2025-37952}
- ksmbd: prevent out-of-bounds stream writes by validating *pos (Norbert Szetei) [Orabug: 37976923] {CVE-2025-37947}
- ksmbd: prevent rename with empty string (Namjae Jeon) [Orabug: 37976972] {CVE-2025-37956}
- can: rockchip_canfd: rkcanfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Niklas Schnelle) [Orabug: 37976920] {CVE-2025-37946}
- vfio/pci: Align huge faults to order (Alex Williamson)
- wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation (Veerendranath Jakkam) [Orabug: 37977046] {CVE-2025-37973}
- s390/pci: Fix missing check for zpci_create_device() error return (Niklas Schnelle) [Orabug: 37977050] {CVE-2025-37974}
- can: mcan: m_can_class_unregister(): fix order of unregistration calls (Marc Kleine-Budde)
- firmware: arm_scmi: Fix timeout checks on polling path (Cristian Marussi)
- arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2 (Wojciech Dubowik)
- Revert "btrfs: canonicalize the device path before adding it" (Qu Wenruo)
- fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (Max Kellermann) [Orabug: 38015155] {CVE-2025-37999}
- dm: add missing unlock on in dm_keyslot_evict() (Dan Carpenter)
- mm/vmscan: wake up flushers conditionally to avoid cgroup OOM (Zeng Jingxiang) [Orabug: 37480932]
- dmaengine: idxd: Narrow the restriction on BATCH to ver. 1 only (Vinicius Costa Gomes) [Orabug: 37801355]
- uek-rpm: build the fwctl mlx5 driver on UEK (Qing Huang) [Orabug: 37810636]
- fwctl: Adapt upstream code for UEK8 (Mikhael Goikhman) [Orabug: 37810636]
- mlx5: Create an auxiliary device for fwctl_mlx5 (Saeed Mahameed) [Orabug: 37810636]
- fwctl/mlx5: Support for communicating with mlx5 fw (Saeed Mahameed) [Orabug: 37810636]
- fwctl: Add documentation (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware (Jason Gunthorpe) [Orabug: 37810636]
- taint: Add TAINT_FWCTL (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_INFO to return basic information about the device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Basic ioctl dispatch for the character device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Add basic structure for a class subsystem with a cdev (Jason Gunthorpe) [Orabug: 37810636]
- Revert "fwctl: Add basic structure for a class subsystem with a cdev" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Basic ioctl dispatch for the character device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_INFO to return basic information about the device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Support for communicating with mlx5 fw" (Qing Huang) [Orabug: 37810636]
- Revert "mlx5: Create an auxiliary device for fwctl_mlx5" (Qing Huang) [Orabug: 37810636]
- Revert "taint: Add TAINT_FWCTL" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Adapt code for UEK-NEXT" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Add INTERNAL_DEV_RES uctx capability" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Allow up to 4k devices" (Qing Huang) [Orabug: 37810636]
- Revert "uek-rpm: build the fwctl mlx5 driver on UEK" (Qing Huang) [Orabug: 37810636]
- dmaengine: idxd: Change err messages to dbg (Jack Vogel) [Orabug: 37841831]
- PCI: Add PCI_VDEVICE_SUB helper macro (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbevf: Add support for Intel(R) E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Enable link management in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Clean up the E610 link management related code (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add ixgbe_x540 multiple header inclusion protection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for EEPROM dump in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for NVM handling in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add link management support for E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 device capabilities detection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 FW Admin Command Interface (Piotr Kwapulinski) [Orabug: 37889575]
- uek-rpm: Move the gve kernel module from extra to kernel-uek-core (Samasth Norway Ananda) [Orabug: 37940897]
- uek-rpm/config-aarch64: Enable BT_HCIUART_BCM for RPi Bluetooth (Vijay Kumar) [Orabug: 37961540]
- platform/mellanox: mlxbf-pmc: Support additional PMC blocks (Shravan Kumar Ramani) [Orabug: 37964051]
- mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug: 37964051,38037120] {CVE-2025-37866}
- mlxbf-bootctl: Support sysfs entries for RTC battery status (Xiangrong Li) [Orabug: 37964051]
- platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37964051]
- uek-rpm: CONFIG_PTP_1588_CLOCK_OCP enable for OCI (Vijayendra Suman) [Orabug: 37966384]
- x86/its: Fix build errors when CONFIG_MODULES=n (Eric Biggers) [Orabug: 37970148]
- x86/its: Use dynamic thunks for indirect branches (Peter Zijlstra) [Orabug: 37970148]
- x86/ibt: Keep IBT disabled during alternative patching (Pawan Gupta) [Orabug: 37970148]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 37989268]
- amd_hsmp: Increase the SMU timeout to 500ms (Vijay Kumar) [Orabug: 38000074]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge)  [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang)  [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming)  [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams)  [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson)  [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley)  [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson)  [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson)  [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang)  [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang)  [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang)  [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang)  [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang)  [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang)  [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie)  [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie)  [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen)  [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen)  [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda)  [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda)  [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.1.el10uek]" date="1750939200">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.2.el10uek]" date="1752148800">- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38178286]  {CVE-2025-38089}
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38162790]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38175263]
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)  [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)  [Orabug: 38175246]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.3.el10uek]" date="1752494400">- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38171405]</changelog>
</package>
<package pkgid="00d28254822d76f6528dda3729b919b22ab6e33a" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="102.36.5.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge) [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang) [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming) [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams) [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson) [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley) [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson) [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson) [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang) [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang) [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang) [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang) [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang) [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang) [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie) [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie) [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen) [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen) [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda) [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda) [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger)  [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan)  [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan)  [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin)
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota)
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu)
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng)
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann)
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo)
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov)
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu)
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi)
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung)
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei Zhang)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Wentao Liang)
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold)
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-ji Chen)
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu)
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett)
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana)
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li (Intel))
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells)
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara)
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko)
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima)
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai)
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee)
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima)
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet)
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer)
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai)
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin)
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (SeongJae Park)
- smb: client: remove 	 from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima)
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski)
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev)
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo)
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski)
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang)
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin.Cao)
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng)
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke)
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun)
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (FUJITA Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin KaFai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu)
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra)
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher)
- smb: client: fix first command failure during re-negotiation (zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich)
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet)
- net: atm: add lec_mutex (Eric Dumazet)
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima)
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg)
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev)
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski)
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu)
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima)
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima)
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov)
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo)
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh AP)
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon)
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka)
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders)
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sá)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott)
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath SM)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal)
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn)
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis)
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam)
- Input: sparcspkr - avoid unannotated fall-through (WangYuli)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar)
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima)
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rong Zhang)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon)
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li (Intel))
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski)
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet)
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath SM)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin)
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov)
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang)
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton)
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes)
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook)
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Wentao Liang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij)
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo)
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner)
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu)
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh AP)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso)
- f2fs: fix to bail out in get_new_segment() (Chao Yu)
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski)
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R)
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin)
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao)
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S)
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (gldrk)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han)
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han)
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn)
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos)
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang)
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang)
- regulator: max14577: Add error check for max14577_read_reg() (Wentao Liang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel Shahrouzi)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann)
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz)
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin)
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Wentao Liang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Wentao Liang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams)
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'ichiro Kawasaki)
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park)
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (GONG Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu)
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim)
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski)
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han)
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu)
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim)
- f2fs: fix to do sanity check on ino and xnid (Chao Yu)
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter)
- ext4: only dirty folios when data journaling regular files (Brian Foster)
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo)
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis)
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko)
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin)
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeff Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar)
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski)
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian)
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev)
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis)
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li)
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Wentao Liang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis)
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park)
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann)
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng)
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (NeilBrown)
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh)
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter)
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Wentao Liang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Wentao Liang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Wentao Liang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F. R. A. Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li (Intel))
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner)
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov)
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt)
- 9p: Add a migrate_folio method (Matthew Wilcox (Oracle))
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (RD Babiera)
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby (SUSE))
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Wupeng Ma)
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard)
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov)
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge)
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox (Oracle))
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox (Oracle))
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig)
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang)
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana)
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski)
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet)
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet)
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet)
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin)
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz)
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski)
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski)
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj)
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui)
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani (IBM))
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet)
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang)
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park)
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz)
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav)
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold)
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro)
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki NAGAO)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski)
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel)
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal)
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari)
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song)
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng)
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré)
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré)
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak)
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas)
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen)
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Yeoreum Yun)
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz)
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (WangYuli)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang)
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin)
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar)
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin)
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang)
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng)
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe JAILLET)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe JAILLET)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski)
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin)
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov)
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin)
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov)
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin)
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei)
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Wentao Liang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher)
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F. R. A. Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo)
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima)
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam)
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur)
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang)
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (KaFai Wan)
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein)
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich)
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen)
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook)
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li RongQing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin)
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin)
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný)
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (ping.gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen)
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu)
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu)
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev)
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring (Arm))
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen)
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko)
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin)
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (YiFei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad)
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso)
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang)
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan)
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma)
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen XIN)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen XIN)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu)
- f2fs: prevent the current section from being selected as a victim during GC (yohan.joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter)
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu)
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen)
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen)
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang)
- xen/x86: fix initial memory balloon target (Roger Pau Monne)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon)
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A. R. Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin)
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe JAILLET)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao)
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao)
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland)
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown)
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han)
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian)
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo)
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot)
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong)
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu)
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F. R. A. Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu (Google))
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby (SUSE))
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait)
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper)
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli)  [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha)  [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137447]  {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky)  [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli)  [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly)  [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry)  [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson)  [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson)  [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry)  [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry)  [Orabug: 38026089]
- xfs: update atomic write limits (John Garry)  [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry)  [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry)  [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry)  [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry)  [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry)  [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong)  [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong)  [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry)  [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong)  [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry)  [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong)  [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong)  [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig)  [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig)  [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry)  [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry)  [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry)  [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry)  [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry)  [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry)  [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry)  [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry)  [Orabug: 38026089]
- dm-table: atomic writes support (John Garry)  [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry)  [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry)  [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry)  [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry)  [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry)  [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry)  [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry)  [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry)  [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry)  [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry)  [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry)  [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry)  [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry)  [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry)  [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry)  [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry)  [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen)  [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge)  [Orabug: 38137957]
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge)  [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge)  [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna)  [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju)  [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.1.el10uek]" date="1754481600">- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann)  [Orabug: 38217337]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.2.el10uek]" date="1755086400">- iommu/vt-d: Fix misplaced domain_attached assignment (Ban ZuoXiang)  [Orabug: 38294635]</changelog>
</package>
<package pkgid="75ca262676303ca8439ce869ee25a678f0612b38" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger) [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo) [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan) [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan) [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
</package>
<package pkgid="525c738d1ac19cee571e6a755bd055dfcff21515" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]  
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
</package>
<package pkgid="1d475c343f5a15fd03fd00d5bb8c108a3bf44c7b" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560} 
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500} 
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566} 
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571} 
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618} 
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
</package>
<package pkgid="cb21d940910fb2da29f95455148a41c12efc62c6" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560}
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500}
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566}
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571}
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618}
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.4.el10uek]" date="1759492800">- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton)  [Orabug: 38500610]  {CVE-2025-38724} 
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38500621]  {CVE-2025-39698} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38500629]  {CVE-2025-39881} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38500632]  {CVE-2025-39866}</changelog>
</package>
<package pkgid="00dc2a12370c2c650b75676ecadfb0a3c72591e6" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="104.43.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
</package>
<package pkgid="cad0a666bdcd127ac12a1bd6b44ce7da33c9c87b" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="104.43.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.3.el10uek]" date="1761220800">- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38572958]  {CVE-2025-39698} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38572953]  {CVE-2025-39866} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38572951]  {CVE-2025-3988} 
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon)  [Orabug: 38572950]  {CVE-2025-39718} 
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38572948]  {CVE-2025-39964} 
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)  [Orabug: 38572947]  {CVE-2025-39963} 
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)  [Orabug: 38572946]  {CVE-2025-39965} 
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski)  [Orabug: 38572944]  {CVE-2025-39946} 
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)  [Orabug: 38572943]  {CVE-2025-39977} 
- i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38572941]  {CVE-2025-39973}</changelog>
</package>
<package pkgid="52766881bf0011e89e487163ae4a8d346cc45474" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="105.51.5.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)
- media: rc: fix races with imon_disconnect() (Larshin Sergey)
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik)
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)
- i40e: add validation for ring_len param (Lukasz Czapnik)
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.1.el10uek]" date="1764590400">- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu)  [Orabug: 38712788]  {CVE-2025-40019} 
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712786]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="ead97a9492c1a015c3c20f49179edb2b2d15e7f2" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="105.51.5.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]  
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]  
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]  
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]  
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]  
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]  
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]  
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]  
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]  
- LTS version: v6.12.51 (Jack Vogel)   
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)   
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)   
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)   
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)   
- media: rc: fix races with imon_disconnect() (Larshin Sergey)   
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)   
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)   
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)   
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)   
- crypto: sha256 - fix crash at kexec (Breno Leitao)   
- LTS version v6.12.50 (Jack Vogel)   
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)   
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)   
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)   
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)   
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)   
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)   
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)   
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)   
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)   
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)   
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)   
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)   
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)   
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)   
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))   
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)   
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)   
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)   
- i40e: add max boundary check for VF filters (Lukasz Czapnik)   
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)   
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)   
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)   
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)   
- i40e: add validation for ring_len param (Lukasz Czapnik)   
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)   
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)   
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)   
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)   
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)   
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)   
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)   
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)   
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)   
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)   
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)   
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)   
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)   
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)   
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)   
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)   
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)   
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)   
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)   
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)   
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)   
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)   
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)   
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)   
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)   
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)   
- wifi: virt_wifi: Fix page fault on connect (James Guan)   
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)   
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)   
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)   
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)   
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)   
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)   
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)   
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)   
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)   
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)   
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)   
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)   
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)   
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)   
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)   
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)   
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)   
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)   
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)   
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)   
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)   
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)   
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)   
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)   
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)   
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
</package>
<package pkgid="474ab4110f26f99314d0d4a6d9e979edef7e2068" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="106.55.4.1.el10uek"/>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="524bf6090d77defbf4dab4a8ae3e3b8c0ed09782" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="106.55.4.2.el10uek"/>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.2.el10uek]" date="1766145600">- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)   {CVE-2025-40271} 
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="634fe106c68a0bc1da7c8b6c2fd1fc99670dc667" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="9fcc1fc62e97f662ed3d3e39bd278bfb4112d241" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
</package>
<package pkgid="e976830d8c02b43a0061f6eb3170d6e4083a0c42" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.4.el10uek]" date="1770292800">- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet)  [Orabug: 38932996]  {CVE-2025-40257} 
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38932973]  {CVE-2025-40149} 
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet)  [Orabug: 38932955]  {CVE-2025-40258} 
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38932939]</changelog>
</package>
<package pkgid="860667567345b40d3ad149db57166be041c2ab24" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="108.64.6.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge) [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp) [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal) [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.62.1.el10uek]" date="1765886400">- uek-rpm: Allow disabling kabichk at command line (Yifei Liu) [Orabug: 38733049]
- Revert "xfrm: Use xdo.dev instead of xdo.real_dev" (Jack Vogel) [Orabug: 38718730]
- Revert "net/mlx5: Fix IPsec cleanup over MPV device" (Jack Vogel) [Orabug: 38718730]
- LTS version: v6.12.62 (Jack Vogel)
- bus: mhi: host: pci_generic: Add Telit FN990B40 modem support (Daniele Palmas)
- bus: mhi: host: pci_generic: Add Telit FN920C04 modem support (Daniele Palmas)
- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (Navaneeth K)
- staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (Navaneeth K)
- staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (Navaneeth K)
- comedi: check device's attached status in compat ioctls (Nikita Zhandarovich)
- comedi: multiq3: sanitize config options in multiq3_attach() (Nikita Zhandarovich)
- comedi: c6xdigio: Fix invalid PNP driver unregistration (Ian Abbott)
- wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (Zenm Chen)
- wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1 (Zenm Chen)
- samples: work around glibc redefining some of our defines wrong (Linus Torvalds)
- LoongArch: Mask all interrupts during kexec/kdump (Huacai Chen)
- HID: elecom: Add support for ELECOM M-XT3URBK (018F) (Naoki Ueki)
- platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (Antheas Kapenekakis)
- platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (Antheas Kapenekakis)
- platform/x86: huawei-wmi: add keys for HONOR models (Ston Jia)
- HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (April Grimoire)
- platform/x86: acer-wmi: Ignore backlight event (Armin Wolf)
- pinctrl: qcom: msm: Fix deadlock in pinmux configuration (Praveen Talari)
- nvme: fix admin request_queue lifetime (Keith Busch) [Orabug: 38773611] {CVE-2025-68265}
- HID: hid-input: Extend Elan ignore battery quirk to USB (Mario Limonciello)
- bfs: Reconstruct file type when loading from disk (Tetsuo Handa)
- ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (Lushih Hsieh)
- drm/amdkfd: Fix GPU mappings for APU after prefetch (Harish Kasiviswanathan)
- smb: fix invalid username check in smb3_fs_context_parse_param() (Yiqi Sun)
- Bluetooth: btrtl: Avoid loading the config file on security chips (Max Chou)
- drm/vmwgfx: Use kref in vmw_bo_dirty (Ian Forbes)
- spi: imx: keep dma request disabled before dma transfer setup (Robin Gong)
- spi: xilinx: increase number of retries before declaring stall (Alvaro Gamez Machado)
- ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() (Song Liu)
- USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- serial: add support of CPCI cards (Magne Bruno)
- USB: serial: ftdi_sio: match on interface number for jtag (Johan Hovold)
- USB: serial: option: move Telit 0x10c7 composition in the right place (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FE910C04 new compositions (Fabio Porcedda)
- USB: serial: option: add Foxconn T99W760 (Slark Xiao)
- KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (Omar Sandoval) [Orabug: 38773578] {CVE-2025-68259}
- comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (Nikita Zhandarovich)
- ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (Alexey Nepomnyashih) [Orabug: 38773586] {CVE-2025-68261}
- locking/spinlock/debug: Fix data-race in do_raw_write_lock (Alexander Sverdlin)
- ksmbd: ipc: fix use-after-free in ipc_msg_send_request (Qianchang Zhao)
- ext4: refresh inline data size before write operations (Deepanshu Kartikey) [Orabug: 38773602] {CVE-2025-68264}
- jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (Ye Bin) [Orabug: 38792632] {CVE-2025-68337}
- Documentation: process: Also mention Sasha Levin as stable tree maintainer (Bagas Sanjaya)
- xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca)
- xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)
- Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca)
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca) [Orabug: 38730491,38854317] {CVE-2025-40215}
- LTS version: v6.12.61 (Jack Vogel)
- spi: spi-nxp-fspi: Check return value of devm_mutex_init() (Thomas Weißschuh)
- drm/i915/dp: Initialize the source OUI write timestamp always (Imre Deak)
- Revert "ACPI: Suppress misleading SPCR console message when SPCR table is absent" (Punit Agrawal)
- wifi: ath12k: correctly handle mcast packets for clients (Sarika Sharma)
- net: dsa: microchip: Free previously initialized ports on init failures (Bastien Curutchet)
- net: dsa: microchip: Do not execute PTP driver code for unsupported switches (Tristram Ha)
- drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (Thomas Zimmermann) [Orabug: 38773709] {CVE-2025-68296}
- net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() (Bastien Curutchet)
- KVM: SVM: Fix redundant updates of LBR MSR intercepts (Yosry Ahmed)
- KVM: nSVM: Fix and simplify LBR virtualization handling with nested (Yosry Ahmed)
- KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() (Yosry Ahmed)
- KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts() (Yosry Ahmed)
- mm/huge_memory: fix NULL pointer deference when splitting folio (Wei Yang) [Orabug: 38773700] {CVE-2025-68293}
- usb: gadget: udc: fix use-after-free in usb_gadget_state_work (Jimmy Hu) [Orabug: 38773635] {CVE-2025-68282}
- usb: udc: Add trace event for usb_gadget_set_state (Kuen-Han Tsai)
- can: rcar_canfd: Fix CAN-FD mode as default (Biju Das)
- usb: typec: ucsi: psy: Set max current to zero when disconnected (Jameson Thies)
- nfsd: Replace clamp_t in nfsd4_get_drc_mem() (Neil Brown)
- staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann)
- libceph: replace BUG_ON with bounds check for map-&gt;max_osd (Ziming Zhang) [Orabug: 38773641] {CVE-2025-68283}
- libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773648] {CVE-2025-68284}
- libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773654] {CVE-2025-68285}
- net: dsa: microchip: Don't free uninitialized ksz_irq (Bastien Curutchet)
- net: dsa: microchip: ptp: Fix checks on irq_find_mapping() (Bastien Curutchet)
- net: dsa: microchip: common: Fix checks on irq_find_mapping() (Bastien Curutchet)
- drm/amd/display: Don't change brightness for disabled connectors (Mario Limonciello)
- drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773661] {CVE-2025-68286}
- drm/amd/amdgpu: reserve vm invalidation engine for uni_mes (Michael Chen)
- drm: sti: fix device leaks at component probe (Johan Hovold)
- USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang)
- USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov)
- xhci: dbgtty: fix device unregister (Łukasz Bartosik)
- xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman)
- xhci: fix stale flag preventig URBs after link state error is cleared (Mathias Nyman)
- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar)
- usb: dwc3: pci: Sort out the Intel device IDs (Krogerus Heikki)
- usb: dwc3: pci: add support for the Intel Nova Lake -S (Krogerus Heikki)
- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792592] {CVE-2025-68331}
- usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762728] {CVE-2025-40345}
- USB: storage: Remove subclass and protocol overrides from Novatek quirk (Alan Stern)
- usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773676] {CVE-2018-1000204,CVE-2025-68288}
- usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea)
- usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai)
- usb: cdns3: Fix double resource release in cdns3_pci_probe (Miaoqian Lin)
- most: usb: fix double free on late probe failure (Johan Hovold)
- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin)
- mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). (Kuniyuki Iwashima)
- mptcp: clear scheduled subflows on retransmit (Paolo Abeni)
- mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level (Jisheng Zhang)
- mm/memfd: fix information leak in hugetlb folios (Deepanshu Kartikey) [Orabug: 38773697] {CVE-2025-68292}
- firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli)
- nvmem: layouts: fix nvmem_layout_bus_uevent (Guan Wentao)
- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin)
- thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski)
- smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773703] {CVE-2025-68295}
- drivers/usb/dwc3: fix PCI parent check (Jamie Iles)
- dm-verity: fix unreliable memory allocation (Mikulas Patocka)
- ceph: fix crash in process_v2_sparse_read() for encrypted directories (Viacheslav Dubeyko) [Orabug: 38773716] {CVE-2025-68297}
- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde)
- can: sja1000: fix max irq loop handling (Thomas Mühlbacher)
- Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref (Douglas Anderson) [Orabug: 38773723] {CVE-2025-68298}
- atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han)
- ARM: dts: nxp: imx6ul: correct SAI3 interrupt line (Maarten Zanders)
- arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity (Xu Yang)
- arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos (Frank Li)
- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (Ivan Zhaldak)
- tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (Deepanshu Kartikey) [Orabug: 38792583] {CVE-2025-68329}
- MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow (Thomas Bogendoerfer)
- MIPS: mm: Prevent a TLB shutdown on initial uniquification (Maciej W. Rozycki)
- iio: adc: rtq6056: Correct the sign bit index (Chiyuan Huang)
- iio: adc: ad7280a: fix ad7280_store_balance_timer() (David Lechner)
- iio: accel: fix ADXL355 startup race condition (Valek Andrej)
- iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792585] {CVE-2025-68330}
- iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling (Olivier Moysan)
- iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet)
- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra)
- iio: humditiy: hdc3020: fix units for thresholds and hysteresis (Dimitri Fedrau)
- iio: humditiy: hdc3020: fix units for temperature and humidity measurement (Dimitri Fedrau)
- iio: buffer: support getting dma channel from the buffer (Nuno Sa)
- iio: buffer-dmaengine: enable .get_dma_dev() (Nuno Sa)
- iio: buffer-dma: support getting the DMA channel (Nuno Sa)
- Revert "perf/x86: Always store regs-&gt;ip in perf_callchain_kernel()" (Jiri Olsa)
- Revert "drm/amd/display: Move setup_stream_attribute" (Alex Deucher)
- spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou)
- spi: nxp-fspi: Propagate fwnode in ACPI case as well (Andy Shevchenko)
- spi: spi-nxp-fspi: Add OCT-DTR mode support (Haibo Chen)
- spi: spi-nxp-fspi: remove the goto in probe (Haibo Chen)
- spi: nxp-fspi: Support per spi-mem operation frequency switches (Miquel Raynal)
- spi: spi-mem: Add a new controller capability (Miquel Raynal)
- spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency (Miquel Raynal)
- spi: spi-mem: Allow specifying the byte order in Octal DTR mode (Tudor Ambarus)
- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (Xu Wang)
- spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA (Francesco Lavra)
- fs/namespace: fix reference leak in grab_requested_mnt_ns (Andrei Vagin) [Orabug: 38773950] {CVE-2025-68300}
- mailbox: pcc: don't zero error register (Jamie Iles)
- mailbox: pcc: Refactor error handling in irq handler into separate function (Sudeep Holla)
- mailbox: mtk-cmdq: Refine DMA address handling for the command buffer (Jason-JH Lin)
- mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang)
- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (Xu Wang)
- iio: st_lsm6dsx: Fixed calibrated timestamp calculation (Mario Tesi)
- net: fec: do not register PPS event for PEROUT (Wei Fang)
- net: fec: do not allow enabling PPS and PEROUT simultaneously (Wei Fang)
- net: fec: do not update PEROUT if it is enabled (Wei Fang)
- net: fec: cancel perout_timer when PEROUT is disabled (Wei Fang)
- net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773728] {CVE-2025-68301}
- eth: fbnic: Fix counter roll-over issue (Mohsin Bashir)
- net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean)
- net: dsa: sja1105: simplify static configuration reload (Russell King)
- net: wwan: mhi: Keep modem name match with Foxconn T99W640 (Slark Xiao)
- drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (Alex Deucher)
- net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev)
- team: Move team device type change at the end of team_port_add (Nikola Z. Ivanov) [Orabug: 38796270] {CVE-2025-68340}
- net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino)
- drm/xe: Fix conversion from clock ticks to milliseconds (Harish Chegondi)
- net: lan966x: Fix the initialization of taprio (Horatiu Vultur)
- net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng)
- platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter)
- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (Daniel Golle)
- veth: reduce XDP no_direct return section to fix race (Jesper Dangaard Brouer) [Orabug: 38796276] {CVE-2025-68341}
- veth: more robust handing of race to avoid txq getting stuck (Jesper Dangaard Brouer)
- veth: prevent NULL pointer dereference in veth_xdp_rcv (Jesper Dangaard Brouer)
- veth: apply qdisc backpressure on full ptr_ring to reduce TX drops (Jesper Dangaard Brouer)
- net: sched: generalize check for no-queue qdisc on TX queue (Jesper Dangaard Brouer)
- Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz)
- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (Edward Adam Davis) [Orabug: 38773949] {CVE-2025-68305}
- Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP (Luiz Augusto von Dentz)
- Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface (Chris Lu) [Orabug: 38773748] {CVE-2025-68306}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data (Marc Kleine-Budde) [Orabug: 38796278] {CVE-2025-68342}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header (Marc Kleine-Budde) [Orabug: 38796285] {CVE-2025-68343}
- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (Marc Kleine-Budde) [Orabug: 38773751] {CVE-2025-68307}
- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [Orabug: 38773759] {CVE-2025-68308}
- LTS version: v6.12.60 (Jack Vogel)
- Revert "gpio: swnode: don't use the swnode's name as the key for GPIO lookup" (Charles Keepax)
- drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched (Fangzhi Zuo)
- drm/amd/display: Insert dccg log for easy debug (Charlene Liu)
- drm/amd/display: disable DPP RCG before DPP CLK enable (Charlene Liu)
- drm/amd/display: avoid reset DTBCLK at clock init (Charlene Liu)
- xfs: fix out of bounds memory read error in symlink repair (Darrick J. Wong) [Orabug: 38730602] {CVE-2025-40246}
- xfs: Replace strncpy with memcpy (Marcelo Moreira)
- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730655] {CVE-2025-40257}
- drm/i915/dp_mst: Disable Panel Replay (Imre Deak)
- maple_tree: fix tracepoint string pointers (Martin Kaiser)
- tty/vt: fix up incorrect backport to stable releases (Jari Ruusu)
- smb: client: fix incomplete backport in cfids_invalidation_worker() (Henrique Carvalho)
- drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (Samuel Zhang) [Orabug: 38773445] {CVE-2025-68230}
- tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun)
- net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
- ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe)
- s390/mm: Fix __ptep_rdp() inline assembly (Heiko Carstens)
- drm/xe: Prevent BIT() overflow when handling invalid prefetch region (Shuicheng Lin)
- Revert "RDMA/irdma: Update Kconfig" (Guan Wentao)
- KVM: arm64: Make all 32bit ID registers fully writable (Marc Zyngier)
- ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai)
- kconfig/nconf: Initialize the default locale at startup (Jakub Horký)
- kconfig/mconf: Initialize the default locale at startup (Jakub Horký)
- net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit)
- blk-crypto: use BLK_STS_INVAL for alignment errors (Carlos Llamas)
- net: tls: Change async resync helpers argument (Shahar Shitrit)
- selftests: net: use BASH for bareudp testing (Po-Hsu Lin)
- x86/microcode/AMD: Limit Entrysign signature checking to known generations (Borislav Petkov)
- scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773425] {CVE-2025-68224}
- cifs: fix typo in enable_gcm_256 module parameter (Steve French)
- bcma: don't register devices disabled in OF (Rafał Miłecki)
- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730610] {CVE-2025-40248}
- cifs: fix memory leak in smb3_fs_context_parse_param error path (Shaurya Rane) [Orabug: 38773403] {CVE-2025-68219}
- LoongArch: Use UAPI types in ptrace UAPI header (Thomas Weißschuh)
- af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic(). (Kuniyuki Iwashima)
- af_unix: Cache state-&gt;msg in unix_stream_read_generic(). (Kuniyuki Iwashima)
- devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (Shay Drory) [Orabug: 38730623] {CVE-2025-40251}
- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (Jared Kangas)
- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (Jared Kangas)
- ice: fix PTP cleanup on driver removal in error path (Grzegorz Nitka) [Orabug: 38773389] {CVE-2025-68215}
- idpf: fix possible vport_config NULL pointer deref in remove (Emil Tantilov) [Orabug: 38773956] {CVE-2025-68213}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730628] {CVE-2025-40252}
- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang)
- selftests: net: lib: Do not overwrite error messages (Ido Schimmel)
- s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
- nvme-multipath: fix lockdep WARN due to partition scan work (Shin'Ichiro Kawasaki) [Orabug: 38773400] {CVE-2025-68218}
- tools: riscv: Fixed misalignment of CSR related definitions (Chen Pei)
- net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730647] {CVE-2025-40254}
- net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() (Pavel Zhigulin)
- net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin)
- drm/tegra: Add call to put_pid() (Prateek Agarwal) [Orabug: 38773463] {CVE-2025-68233}
- mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
- platform/x86: msi-wmi-platform: Fix typo in WMI GUID (Armin Wolf)
- platform/x86: msi-wmi-platform: Only load on MSI devices (Armin Wolf)
- pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() (Xu Wang)
- xfrm: Prevent locally generated packets from direct output in tunnel mode (Jianbo Liu)
- xfrm: Determine inner GSO type from packet inner protocol (Jianbo Liu)
- pinctrl: realtek: Select REGMAP_MMIO for RTD driver (Yu-Chun Lin)
- xfrm: set err and extack on failure to create pcpu SA (Sabrina Dubroca)
- xfrm: drop SA reference in xfrm_state_update if dir doesn't match (Sabrina Dubroca)
- drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 (Ivan Lipski)
- drm/amd/display: Fix pbn to kbps Conversion (Fangzhi Zuo)
- drm/amd/display: Move sleep into each retry for retrieve_link_cap() (Mario Limonciello)
- drm/amd/display: Increase DPCD read retries (Mario Limonciello)
- drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (Yifan Zha)
- drm/amd: Skip power ungate during suspend for VPE (Mario Limonciello)
- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (Robert Mcclinton) [Orabug: 38773418] {CVE-2025-68223}
- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke)
- mptcp: do not fallback when OoO is present (Paolo Abeni)
- mptcp: decouple mptcp fastclose from tcp close (Paolo Abeni)
- mptcp: avoid unneeded subflow-level drops (Paolo Abeni)
- selftests: mptcp: join: userspace: longer timeout (Matthieu Baerts)
- selftests: mptcp: join: endpoints: longer timeout (Matthieu Baerts)
- mptcp: fix premature close in case of fallback (Paolo Abeni)
- mptcp: fix duplicate reset on fastclose (Paolo Abeni)
- mptcp: fix ack generation for fallback msk (Paolo Abeni)
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730658] {CVE-2025-40258}
- LoongArch: Don't panic if no valid cache info for PCI (Huacai Chen)
- dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski)
- MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
- scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773439] {CVE-2025-68229}
- scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730661] {CVE-2025-40259}
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730672] {CVE-2025-40261}
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne)
- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (Nam Cao) [Orabug: 38773467] {CVE-2025-68235}
- mm/mempool: fix poisoning order&gt;0 pages with HIGHMEM (Vlastimil Babka) [Orabug: 38773453] {CVE-2025-68231}
- Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
- Input: imx_sc_key - fix memory corruption on unload (Dan Carpenter)
- Input: goodix - add support for ACPI ID GDIX1003 (Hans de Goede)
- Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730679] {CVE-2025-40263}
- Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" (Diogo Ivo)
- net: dsa: microchip: lan937x: Fix RGMII delay tuning (Oleksij Rempel)
- be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730688] {CVE-2025-40264}
- ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() (Yihang Li)
- smb: client: introduce close_cached_dir_locked() (Henrique Carvalho)
- ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
- mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773434] {CVE-2025-68227}
- mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen)
- exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang)
- shmem: fix tmpfs reconfiguration (remount) when noswap is set (Mike Yuan)
- isofs: check the return value of sb_min_blocksize() in isofs_fill_super (Yongpeng Yang)
- mtdchar: fix integer overflow in read/write ioctls (Dan Carpenter) [Orabug: 38773476] {CVE-2025-68237}
- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara)
- arm64: dts: rockchip: disable HS400 on RK3588 Tiger (Quentin Schulz)
- arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1 (Quentin Schulz)
- arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5 (Mykola Kvach)
- arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2 (Diederik de Haas)
- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
- HID: amd_sfh: Stop sensor before starting (Mario Limonciello)
- timers: Fix NULL function pointer race in timer_shutdown_sync() (Yipeng Zou) [Orabug: 38773387] {CVE-2025-68214}
- KVM: arm64: Check the untrusted offset in FF-A memory share (Sebastian Ene) [Orabug: 38730696] {CVE-2025-40266}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.2.el10uek]" date="1766491200">- LTS version: v6.12.63 (Jack Vogel)
- ASoC: codecs: nau8325: Silence uninitialized variables warnings (Krzysztof Kozlowski)
- ALSA: wavefront: Fix integer overflow in sample size validation (Junrui Luo)
- ALSA: dice: fix buffer overflow in detect_stream_formats() (Junrui Luo)
- usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required (Sven Peter)
- usb: phy: Initialize struct usb_phy list_head (Diogo Ivo)
- usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (Haotien Hsu)
- tcp_metrics: use dst_dev_net_rcu() (Eric Dumazet) [Orabug: 38592188] {CVE-2025-40075}
- net: dst: introduce dst-&gt;dev_rcu (Eric Dumazet)
- net: lan743x: Allocate rings outside ZONE_DMA (Thangaraj Samynathan)
- LoongArch: Add machine_kexec_mask_interrupts() implementation (Huacai Chen)
- ocfs2: fix memory leak in ocfs2_merge_rec_left() (Dmitry Antipov)
- irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (Dan Carpenter)
- scsi: imm: Fix use-after-free bug caused by unfinished delayed work (Duoming Zhou) [Orabug: 38783113] {CVE-2025-68324}
- efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs (Mauro Carvalho Chehab)
- efi/cper: Adjust infopfx size to accept an extra space (Mauro Carvalho Chehab)
- efi/cper: Add a new helper function to print bitmasks (Mauro Carvalho Chehab)
- dm log-writes: Add missing set_freezable() for freezable kthread (Xu Wang)
- dm-raid: fix possible NULL dereference with undefined raid type (Alexey Simakov)
- block: return unsigned int from queue_dma_alignment (Christoph Hellwig)
- block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set-&gt;tag_list_lock (Mohamed Khalfella) [Orabug: 38818209] {CVE-2025-68756}
- ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() (Pangliyuan)
- ALSA: firewire-motu: add bounds check in put_user loop for DSP events (Junrui Luo)
- rtc: gamecube: Check the return value of ioremap() (Xu Wang)
- drm/amdkfd: Use huge page size to check split svm range alignment (Xiaogang Chen)
- ALSA: uapi: Fix typo in asound.h comment (Andres J Rosa)
- docs: hwmon: fix link to g762 devicetree binding (Kathara Sasikumar)
- cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 (David Howells)
- drm/nouveau: refactor deprecated strcpy (Madhur Kumar)
- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (Junrui Luo)
- regulator: fixed: Rely on the core freeing the enable GPIO (Mark Brown)
- drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() (Dan Carpenter)
- nvme-auth: use kvfree() for memory allocated with kvcalloc() (Israel Rukshin)
- block: fix memory leak in __blkdev_issue_zero_pages (Shaurya Rane) [Orabug: 38798772] {CVE-2025-68348}
- block: fix comment for op_is_zone_mgmt() to include RESET_ALL (Shechenglong)
- blk-mq: Abort suspend when wakeup events are pending (Cong Zhang)
- ASoC: ak5558: Disable regulator when error happens (Shengjiu Wang)
- ASoC: ak4458: Disable regulator when error happens (Shengjiu Wang)
- ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (Xu Wang)
- platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (Anton Khirnov)
- fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() (Armin Wolf)
- NFS: Fix inheritance of the block sizes when automounting (Trond Myklebust)
- Expand the type of nfs_fattr-&gt;valid (Trond Myklebust)
- NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (Trond Myklebust) [Orabug: 38818236] {CVE-2025-68764}
- Revert "nfs: ignore SB_RDONLY when mounting nfs" (Trond Myklebust)
- Revert "nfs: clear SB_RDONLY before getting superblock" (Trond Myklebust)
- Revert "nfs: ignore SB_RDONLY when remounting nfs" (Trond Myklebust)
- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (Jonathan Curley) [Orabug: 38798774] {CVE-2025-68349}
- NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state (Trond Myklebust)
- nfs/vfs: discard d_exact_alias() (Neil Brown)
- NFS: Initialise verifiers for visible dentries in nfs_atomic_open() (Trond Myklebust)
- NFS: Initialise verifiers for visible dentries in readdir and lookup (Trond Myklebust)
- fs/nls: Fix utf16 to utf8 conversion (Armin Wolf)
- NFS: Avoid changing nlink when file removes and attribute updates race (Trond Myklebust)
- f2fs: maintain one time GC mode is enabled during whole zoned GC cycle (Daeho Jeong)
- f2fs: add gc_boost_gc_greedy sysfs node (Daeho Jeong)
- f2fs: add gc_boost_gc_multiple sysfs node (Daeho Jeong)
- f2fs: introduce reserved_pin_section sysfs entry (Chao Yu)
- f2fs: sysfs: add encoding_flags entry (Chao Yu)
- f2fs: add carve_out sysfs node (Daeho Jeong)
- f2fs: fix to avoid running out of free segments (Chao Yu)
- f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages (Jaegeuk Kim)
- f2fs: keep POSIX_FADV_NOREUSE ranges (Jaegeuk Kim)
- platform/x86:intel/pmc: Update Arrow Lake telemetry GUID (Xi Pardee)
- sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out (Xupengbo)
- 9p: fix cache/debug options printing in v9fs_show_options (Eric Sandeen)
- fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (Abdun Nihaal)
- pinctrl: single: Fix incorrect type for error return variable (Xu Wang)
- perf hist: In init, ensure mem_info is put on error paths (Ian Rogers)
- perf tools: Fix split kallsyms DSO counting (Namhyung Kim)
- perf tools: Mark split kallsyms DSOs as loaded (Namhyung Kim)
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei) [Orabug: 38783136] {CVE-2025-68325}
- net: dsa: xrs700x: reject unsupported HSR configurations (Vladimir Oltean)
- net: hsr: create an API to get hsr port type (Xiaoliang Yang)
- net: hsr: Create and export hsr_get_port_ndev() (Md Danish Anwar)
- net: hsr: remove synchronize_rcu() from hsr_add_port() (Eric Dumazet)
- net: hsr: remove one synchronize_rcu() from hsr_del_port() (Eric Dumazet)
- clk: keystone: fix compile testing (Johan Hovold)
- md/raid5: fix IO hang when array is broken with IO inflight (Yu Kuai)
- remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs (Alexandru Gagniuc)
- mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (Ivan Stepchenko)
- selftests: bonding: add delay before each xvlan_over_bond connectivity check (Hangbin Liu)
- selftests: bonding: add ipvlan over bond testing (Etienne Champetier)
- net: phy: aquantia: check for NVMEM deferral (Robert Marko)
- vfio/pci: Use RCU for error/request triggers to avoid circular locking (Alex Williamson)
- spi: ch341: fix out-of-bounds memory access in ch341_transfer_one (Tianchu Chen)
- mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (Xu Wang)
- net: stmmac: fix rx limit check in stmmac_rx_zc() (Alexey Kodanev)
- netfilter: nft_connlimit: update the count if add was skipped (Fernando Fernandez Mancera)
- netfilter: nf_conncount: rework API to use sk_buff directly (Fernando Fernandez Mancera)
- netfilter: flowtable: check for maximum number of encapsulations in bridge vlan (Pablo Neira Ayuso)
- Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" (Ilias Stamatis)
- resource: introduce is_type_match() helper and use it (Andy Shevchenko)
- resource: replace open coded resource_intersection() (Andy Shevchenko)
- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (Sparkhuang) [Orabug: 38798786] {CVE-2025-68354}
- ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND (Mikhail Kshevetskiy)
- ASoC: Intel: catpt: Fix error path in hw_params() (Cezary Rojewski)
- vdpa/pds: use %pe for ERR_PTR() in event handler registration (Alok Tiwari)
- vhost: Fix kthread worker cgroup failure handling (Mike Christie)
- vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues (Alok Tiwari)
- virtio: fix virtqueue_set_affinity() docs (Michael S. Tsirkin)
- virtio: fix grammar in virtio_queue_info docs (Michael S. Tsirkin)
- virtio: fix whitespace in virtio_config_ops (Michael S. Tsirkin)
- virtio: fix typo in virtio_device_ready() comment (Michael S. Tsirkin)
- virtio_vdpa: fix misleading return in void function (Alok Tiwari)
- of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node (Guenter Roeck)
- ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation (Yongjian Sun)
- ublk: prevent invalid access with DEBUG (Kevin Brodsky)
- ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (René Rebe)
- hwmon: sy7636a: Fix regulator_enable resource leak on error path (Xu Wang)
- drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (Dan Carpenter)
- greybus: gb-beagleplay: Fix timeout handling in bootloader functions (Xu Wang)
- firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER (Alexandre Courbot)
- ASoC: fsl_xcvr: clear the channel status control memory (Shengjiu Wang)
- gfs2: Prevent recursive memory reclaim (Andreas Gruenbacher) [Orabug: 38798793] {CVE-2025-68356}
- ASoC: nau8325: add missing build config (Jaroslav Kysela)
- ASoC: nau8325: use simple i2c probe function (Jaroslav Kysela)
- drm/panthor: Avoid adding of kernel BOs to extobj list (Akash Goel)
- RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY (Jacob Moroni)
- RDMA/irdma: Fix data race in irdma_free_pble (Krzysztof Czurylo)
- RDMA/irdma: Fix data race in irdma_sc_ccq_arm (Krzysztof Czurylo)
- iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal (Stephan Gerhold)
- backlight: lp855x: Fix lp855x.h kernel-doc warnings (Randy Dunlap)
- backlight: led-bl: Add devlink to supplier LEDs (Luca Ceresoli)
- wifi: ieee80211: correct FILS status codes (Ria Thomas)
- iomap: always run error completions in user context (Christoph Hellwig)
- iomap: factor out a iomap_dio_done helper (Christoph Hellwig)
- um: Don't rename vmap to kernel_vmap (David Gow)
- drm/nouveau: restrict the flush page to a 32-bit address (Timur Tabi)
- PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (Shawn Lin)
- btrfs: fix leaf leak in an error path in btrfs_del_items() (Filipe Manana)
- iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables (Ryan Huang)
- staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (Jianglei Nie)
- firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (Dinh Nguyen)
- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (Zilin Guan)
- ASoC: tas2781: correct the wrong period (Shenghao Ding)
- RDMA/bnxt_re: Pass correct flag for dma mr creation (Selvin Xavier)
- RDMA/bnxt_re: Fix the inline size for GenP7 devices (Selvin Xavier)
- erofs: limit the level of fs stacking for file-backed mounts (Gao Xiang)
- RISC-V: KVM: Fix guest page fault within HLV* instructions (Fangyu Yu)
- crypto: ccree - Correctly handle return of sg_nents_for_len (Xu Wang)
- crypto: starfive - Correctly handle return of sg_nents_for_len (Xu Wang)
- selftests/bpf: Improve reliability of test_perf_branches_no_hw() (Matt Bobrowski)
- selftests/bpf: skip test_perf_branches_hw() on unsupported platforms (Matt Bobrowski)
- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon)
- usb: dwc2: fix hang during suspend if set as peripheral (Jisheng Zhang)
- usb: dwc2: fix hang during shutdown if set as peripheral (Jisheng Zhang)
- usb: dwc2: disable platform lowlevel hw resources during shutdown (Jisheng Zhang)
- usb: chaoskey: fix locking for O_NONBLOCK (Oliver Neukum)
- ima: Handle error code returned by ima_filter_rule_match() (Zhao Yipeng) [Orabug: 38798921] {CVE-2025-68740}
- RAS: Report all ARM processor CPER information to userspace (Jason Tian)
- wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (Seungjin Bae) [Orabug: 38798814] {CVE-2025-68362}
- cpuset: Treat cpusets in attaching as populated (Chen Ridong)
- net: phy: adin1100: Fix software power-down ready condition (Alexander Dahl)
- phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth (Cristian Ciocaltea)
- phy: freescale: Initialize priv-&gt;lock (Xiaolei Wang)
- phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (Christophe Jaillet)
- leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM (Fenglin Wu)
- mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- wifi: mac80211: fix CMAC functions not handling errors (Chien Wong)
- iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb (Aashish Sharma)
- scsi: qla2xxx: Fix improper freeing of purex item (Zilin Guan) [Orabug: 38798928] {CVE-2025-68741}
- pwm: bcm2835: Make sure the channel is enabled after pwm_request() (Uwe Kleine-König)
- perf arm_spe: Fix memset subclass in operation (Leo Yan)
- perf arm-spe: Extend branch operations (Leo Yan)
- ipv6: clear RA flags when adding a static route (Fernando Fernandez Mancera)
- drm/msm/a6xx: Improve MX rail fallback in RPMH vote init (Akhil P Oommen)
- drm/msm/a6xx: Fix the gemnoc workaround (Akhil P Oommen)
- drm/msm/a6xx: Flush LRZ cache before PT switch (Akhil P Oommen)
- drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (Jay Liu)
- fs/ntfs3: Prevent memory leaks in add sub record (Edward Adam Davis)
- fs/ntfs3: out1 also needs to put mi (Edward Adam Davis)
- powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format (Ritesh Harjani)
- powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit (Ritesh Harjani)
- bpf: Fix invalid prog-&gt;stats access when update_effective_progs fails (Pu Lehui) [Orabug: 38798931] {CVE-2025-68742}
- wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (Abdun Nihaal) [Orabug: 38818221] {CVE-2025-68759}
- drm/msm/a2xx: stop over-complaining about the legacy firmware (Dmitry Baryshkov)
- block/blk-throttle: Fix throttle slice time for SSDs (Guenter Roeck)
- NFSD/blocklayout: Fix minlength check in proc_layoutget (Sergey Bashirov)
- tracefs: fix a leak in eventfs_create_events_dir() (Al Viro)
- watchdog: starfive: Fix resource leak in probe error path (Xu Wang)
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (Xu Wang)
- bpf: Check skb-&gt;transport_header is set in bpf_skb_check_mtu (Martin Kafai Lau) [Orabug: 38798820] {CVE-2025-68363}
- selftests/bpf: Fix failure paths in send_signal test (Alexei Starovoitov)
- bpf: Handle return value of ftrace_set_filter_ip in register_fentry (Menglong Dong)
- ps3disk: use memcpy_{from,to}_bvec index (René Rebe)
- drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype (Dmitry Baryshkov)
- crypto: iaa - Fix incorrect return value in save_iaa_wq() (Zilin Guan)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C (Fukaumi Naoki)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A (Fukaumi Naoki)
- arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A (Fukaumi Naoki)
- PCI: keystone: Exit ks_pcie_probe() for invalid mode (Siddharth Vadapalli)
- bpf: Free special fields when update [lru_,]percpu_hash maps (Leon Hwang) [Orabug: 38798936] {CVE-2025-68744}
- leds: netxbig: Fix GPIO descriptor leak in error paths (Xu Wang)
- scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls (Xu Wang)
- ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (Xu Wang)
- ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() (Dmitry Antipov) [Orabug: 38798823] {CVE-2025-68364}
- lib/vsprintf: Check pointer before dereferencing in time_and_date() (Andy Shevchenko)
- clk: renesas: r9a06g032: Fix memory leak in error path (Xu Wang)
- coresight: etm4x: Add context synchronization before enabling trace (Leo Yan)
- coresight: etm4x: Extract the trace unit controlling (Leo Yan)
- coresight: etm4x: Correct polling IDLE bit (Leo Yan)
- coresight: Change device mode to atomic type (Leo Yan)
- nbd: defer config unlock in nbd_genl_connect (Zheng Qixing) [Orabug: 38798832] {CVE-2025-68366}
- wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (Abdun Nihaal)
- macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (Long Li) [Orabug: 38798837] {CVE-2025-68367}
- powerpc/32: Fix unpaired stwcx. on interrupt exit (Christophe Leroy)
- powerpc/kdump: Fix size calculation for hot-removed memory ranges (Sourabh Jain)
- cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs (Gautham R. Shenoy)
- scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() (Bean Huo)
- drm/panthor: Fix potential memleak of vma structure (Akash Goel)
- ntfs3: init run lock for extend inode (Edward Adam Davis)
- ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties (Jihed Chaibi)
- RDMA/rtrs: server: Fix error handling in get_or_create_srv (Ma Ke)
- dt-bindings: PCI: amlogic: Fix the register name of the DBI region (Manivannan Sadhasivam)
- scsi: smartpqi: Fix device resources accessed after device removal (Mike Mcgowen) [Orabug: 38798847] {CVE-2025-68371}
- scsi: stex: Fix reboot_notifier leak in probe error path (Xu Wang)
- nbd: defer config put in recv_work (Zheng Qixing) [Orabug: 38798850] {CVE-2025-68372}
- md: fix rcu protection in md_wakeup_thread (Yun Zhou) [Orabug: 38798857] {CVE-2025-68374}
- regulator: core: disable supply if enabling main regulator fails (Gabor Juhos)
- perf/x86/intel: Correct large PEBS flag check (Dapeng Mi)
- ext4: correct the checking of quota files before moving extents (Zhang Yi)
- mfd: da9055: Fix missing regmap_del_irq_chip() in error path (Xu Wang)
- locktorture: Fix memory leak in param_set_cpumask() (Wang Liang)
- efi/libstub: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- x86/boot: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels (Yegor Yefremov)
- libbpf: Fix parsing of multi-split BTF (Alan Maguire)
- spi: tegra210-quad: Fix timeout handling (Vishwaroop A) [Orabug: 38798943] {CVE-2025-68746}
- drm/panthor: Fix UAF on kernel BO VA nodes (Boris Brezillon)
- drm/panthor: Fix race with suspend during unplug (Ketil Johnsen)
- drm/panthor: Fix UAF race between device unplug and FW event processing (Ketil Johnsen)
- drm/panthor: Fix group_free_queue() for partially initialized queues (Boris Brezillon)
- drm/panthor: Handle errors returned by drm_sched_entity_init() (Boris Brezillon)
- fs/9p: Don't open remote file with APPEND mode when writeback cache is used (Tingmao Wang)
- scsi: target: Do not write NUL characters into ASCII configfs output (Bart Van Assche)
- power: supply: apm_power: only unset own apm_get_power_status (Ahelenia Ziemiańska)
- power: supply: wm831x: Check wm831x_set_bits() return value (Ivan Abramov)
- power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (Murad Masimov)
- power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (Ivan Abramov)
- power: supply: max17040: Check iio_read_channel_processed() return code (Ivan Abramov)
- power: supply: cw2015: Check devm_delayed_work_autocancel() return code (Ivan Abramov)
- power: supply: rt5033_charger: Fix device node reference leaks (Xu Wang)
- perf record: skip synthesize event when open evsel failed (Shuai Xue)
- perf lock contention: Load kernel map before lookup (Namhyung Kim)
- drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() (Geert Uytterhoeven)
- interconnect: debugfs: Fix incorrect error handling for NULL path (Kuan-Wei Chiu)
- arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller (Dmitry Baryshkov)
- interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS (Dmitry Baryshkov)
- wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() (Abdun Nihaal)
- i3c: master: svc: Prevent incomplete IBI transaction (Stanley Chu)
- i3c: fix refcount inconsistency in i3c_master_register (Frank Li)
- pinctrl: stm32: fix hwspinlock resource leak in probe function (Xu Wang)
- soc: qcom: smem: fix hwspinlock resource leak in probe error paths (Xu Wang)
- tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set (Benjamin Berg)
- x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() (Tengda Wu)
- task_work: Fix NMI race condition (Peter Zijlstra)
- perf/x86/intel/cstate: Remove PC3 support from LunarLake (Zhang Rui)
- bpf: Fix stackmap overflow check in __bpf_get_stackid() (Arnaud Lecomte) [Orabug: 38798864] {CVE-2025-68378}
- bpf: Refactor stack map trace depth calculation into helper function (Arnaud Lecomte)
- perf: Remove get_perf_callchain() init_nr argument (Josh Poimboeuf)
- mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (Xu Wang)
- mtd: nand: relax ECC parameter validation check (Aryan Srivastava)
- Revert "mtd: rawnand: marvell: fix layouts" (Aryan Srivastava)
- ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties (Wolfram Sang)
- ARM: dts: renesas: gose: Remove superfluous port property (Wolfram Sang)
- RDMA/rxe: Fix null deref on srq-&gt;rq.queue after resize failure (Zhu Yanjun) [Orabug: 38798867] {CVE-2025-68379}
- sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Kuniyuki Iwashima)
- phy: mscc: Fix PTP for VSC8574 and VSC8572 (Horatiu Vultur)
- arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory (Alexander Martinz)
- arm64: dts: qcom: sm8650: set ufs as dma coherent (Neil Armstrong)
- arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider (Gergo Koteles)
- arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller (Krishna Kurapati)
- arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller (Krishna Kurapati)
- firmware: imx: scu-irq: fix OF node leak in (Peng Fan)
- arm64: dts: ti: k3-am62p: Fix memory ranges for GPU (Randolph Sapp)
- s390/ap: Don't leak debug feature files if AP instructions are not available (Heiko Carstens)
- s390/smp: Fix fallback CPU detection (Heiko Carstens)
- wifi: ath11k: fix peer HE MCS assignment (Baochen Qiang) [Orabug: 38798872] {CVE-2025-68380}
- wifi: ath11k: fix VHT MCS assignment (Baochen Qiang)
- crypto: hisilicon/qm - restore original qos values (Nieweiqiang)
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (Thorsten Blum) [Orabug: 38798874] {CVE-2025-68724}
- soc: qcom: gsbi: fix double disable caused by devm (Xu Wang)
- soc: Switch back to struct platform_driver::remove() (Uwe Kleine-König)
- clk: qcom: camcc-sm7150: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (Li Qiang)
- PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (Geert Uytterhoeven)
- arm64: dts: exynos: gs101: fix sysreg_apm reg property (Peter Griffin)
- perf annotate: Check return value of evsel__get_arch() properly (Tianyou Li)
- arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 (Tim Harvey)
- arm64: dts: imx8mp-venice-gw702x: remove off-board uart (Tim Harvey)
- arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl (Tim Harvey)
- arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props (Tim Harvey)
- block/mq-deadline: Switch back to a single dispatch list (Bart Van Assche)
- block/mq-deadline: Introduce dd_start_request() (Bart Van Assche)
- firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc (Randy Dunlap)
- iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (Francesco Lavra)
- inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() (Luoxuanqiang)
- inet: Avoid ehash lookup race in inet_ehash_insert() (Luoxuanqiang)
- rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() (Luoxuanqiang)
- clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets (Stephan Gerhold)
- ntfs3: Fix uninit buffer allocated by __getname() (Sidharth Seela)
- ntfs3: fix uninit memory after failed mi_read in mi_format_new (Raphael Pinsonneault-Thibeault)
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Herbert Xu)
- irqchip/qcom-irq-combiner: Fix section mismatch (Johan Hovold)
- irqchip/starfive-jh8100: Fix section mismatch (Johan Hovold)
- irqchip/renesas-rzg2l: Fix section mismatch (Johan Hovold)
- irqchip/imx-mu-msi: Fix section mismatch (Johan Hovold)
- irqchip/irq-brcmstb-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7120-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7038-l1: Fix section mismatch (Johan Hovold)
- sched/fair: Forfeit vruntime on yield (Fernand Sieber)
- wifi: ath11k: restore register window after global reset (Baochen Qiang)
- wifi: ath10k: move recovery check logic into a new work (Kang Yang)
- wifi: ath10k: Add missing include of export.h (Jeff Johnson)
- wifi: ath10k: Avoid vdev delete timeout when firmware is already down (Loic Poulain)
- objtool: Fix weak symbol detection (Josh Poimboeuf)
- objtool: Fix standalone --hacks=jump_label (Dylan Hatch)
- HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (Mavroudis Chatzilazaridis)
- drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() (Cyrille Pitchen)
- clk: renesas: cpg-mssr: Read back reset registers to assure values latched (Marek Vasut)
- clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register (Thierry Bultel)
- clk: renesas: Use str_on_off() helper (Geert Uytterhoeven)
- clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (Marek Vasut)
- pinctrl: renesas: rzg2l: Fix PMC restore (Biju Das)
- USB: Fix descriptor count when handling invalid MBIM extended descriptor (Seungjin Bae)
- drm/vgem-fence: Fix potential deadlock on release (Janusz Krzysztofik) [Orabug: 38818211] {CVE-2025-68757}
- accel/ivpu: Fix DCT active percent format (Karol Wachowski)
- accel/ivpu: Make function parameter names consistent (Jacek Lawrynowicz)
- drm/panel: visionox-rm69299: Don't clear all mode flags (Guido Günther)
- accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail (Karol Wachowski)
- accel/ivpu: Prevent runtime suspend during context abort work (Andrzej Kacprowski)
- gpu: host1x: Fix race in syncpt alloc/free (Mainak Sen) [Orabug: 38798898] {CVE-2025-68732}
- smack: fix bug: setting task label silently ignores input garbage (Konstantin Andreev)
- smack: fix bug: unprivileged task can create labels (Konstantin Andreev)
- smack: fix bug: invalid label of unix socket file (Konstantin Andreev)
- smack: always "instantiate" inode in smack_inode_init_security() (Konstantin Andreev)
- smack: deduplicate xattr setting in smack_inode_init_security() (Konstantin Andreev)
- smack: fix bug: SMACK64TRANSMUTE set on non-directory (Konstantin Andreev)
- smack: deduplicate "does access rule request transmutation" (Konstantin Andreev)
- net/mlx5e: Set default burst period for TX and RX reporters (Shahar Shitrit) [Orabug: 38636804]
- devlink: Make health reporter burst period configurable (Shahar Shitrit) [Orabug: 38636804]
- devlink: Introduce burst period for health reporter (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move health reporter recovery abort logic to a separate function (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move graceful period parameter to reporter ops (Shahar Shitrit) [Orabug: 38636804]
- devlink: use devlink_nl_put_u64() helper (Przemek Kitszel) [Orabug: 38636804]
- devlink: introduce devlink_nl_put_u64() (Przemek Kitszel) [Orabug: 38636804]
- Revert "net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery" (Qing Huang) [Orabug: 38636804]
- net/rds: improve conn destroy printk message (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: expand kref coverage to rds_notifier-&gt;n_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: rds_sendmsg must use rs_conn only when not being destroyed (Sharath Srinivasan) [Orabug: 38728742]
- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang) [Orabug: 38766139]
- mm: list_lru: avoid using NULL list_lru_one. (Imran Khan) [Orabug: 38787957]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg)
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa)
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn)
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe)
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping)
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen)
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan)
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo) [Orabug: 38847806] {CVE-2025-68789}
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera)
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38649136]  {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.1.el10uek]" date="1769688000">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang)  [Orabug: 38899652]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.2.el10uek]" date="1770897600">- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan)  [Orabug: 38937451]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.3.el10uek]" date="1771329600">- net/rds: Fix issue with a revert in rds_send_queue_rm (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
</package>
<package pkgid="56900eee08d706a7a52d4a866d0c32a46b681b07" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="109.67.6.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg) [Orabug: 38887626] {CVE-2025-71156}
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa) [Orabug: 38887628] {CVE-2025-71157}
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn) [Orabug: 38887618] {CVE-2025-71154}
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe) [Orabug: 38887603] {CVE-2025-71149}
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping) [Orabug: 38887600] {CVE-2025-71148}
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen) [Orabug: 38887596] {CVE-2025-71147}
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan) [Orabug: 38887608] {CVE-2025-71151}
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo)
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera) [Orabug: 38887785] {CVE-2025-71146}
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.6.el10uek]" date="1772884800">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong)  [Orabug: 39027305]</changelog>
</package>
<package pkgid="8a79c7c087d17d19701c99b0a0dd15191e15e134" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315]</changelog>
</package>
<package pkgid="af7ca4a1cceb787da2043c5c452fcca61c1980af" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-200.74.27.2.el10uek]" date="1775649600">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39186444]  {CVE-2025-40135} 
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39181102]  {CVE-2026-23231} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39181101]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="9d5c943868b8f9c7d6b705cd12db24f12ff90615" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]  
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]  
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
</package>
<package pkgid="8ee0387bd283a6d6a6dc3a587b0c757616bcb7b3" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]  
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]  
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="16489470be93b387aee127b906be36e5e29ff862" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]  
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]  
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431} 
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]  
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]  
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]  
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
</package>
<package pkgid="02b1bc2ad8c4668599dc624b54b629fddb06346d" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-201.74.2.3.el10uek]" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39342689]  {CVE-2026-43500} 
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39342689]  
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39342689]  
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39342689]  
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39342689]  {CVE-2026-43284}</changelog>
</package>
<package pkgid="c0bea2f8b4b3e90f9f35247d5346e890282edeeb" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck)
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park)
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong)
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck)
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu)
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong)
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N)
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He)
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin)
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian)
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko)
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu)
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N)
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo)
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement)
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K)
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen)
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy)
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle)
- kexec: derive purgatory entry from symbol (Li Chen)
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao)
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez)
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey)
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang)
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev)
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong)
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong)
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson)
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo)
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig)
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav)
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed)
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang)
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao)
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal)
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal)
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li)
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li)
- media: radio-keene: fix memory leak in error path (Shaurya Rane)
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack)
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack)
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack)
- HID: hid-pl: handle probe errors (Oliver Neukum)
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson)
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers)
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han)
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian)
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski)
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu)
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni)
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo)
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi)
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo)
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa)
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen)
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai)
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt)
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov)
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal)
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li)
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni)
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek)
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui)
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith)
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith)
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai)
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan)
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan)
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus)
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook)
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek)
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin)
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu)
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao)
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi)
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen)
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang)
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li)
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab)
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab)
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab)
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab)
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang)
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho)
- gfs2: fiemap page fault fix (Andreas Gruenbacher)
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang)
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn)
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150]
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116]
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972]
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500} 
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]  
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513]  
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]  
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]  
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]  
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284} 
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
</package>
<package pkgid="2d8650412bdfed5dd4bd70763c37609fa3088d77" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974] {CVE-2026-43129}
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270} 
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278} 
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
</package>
<package pkgid="2b85c482fd90c25c3c5d49842d85097d34052590" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278}
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-202.76.4.3.el10uek]" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391434]  {CVE-2026-46333}</changelog>
</package>
<package pkgid="4889eeb50485a3337d76570ed36972f0738a5417" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144] {CVE-2025-39858}
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) {CVE-2025-40219}
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 38649060]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 38887740]  {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39029337] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39144150] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao)  [Orabug: 39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A)  [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A)  [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu)  [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu)  [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu)  [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu)  [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski)  [Orabug: 39166116]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.3.el10uek]" date="1777377600">- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39276931]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39276921]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39276912]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.el10uek]" date="1777636800">- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292218]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291972]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291972] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291972]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291972]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291972]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291972]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.1.el10uek]" date="1778328000">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39344513]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39344513]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39344513] {CVE-2026-31676}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39344513]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39344513]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39344513]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344513]  {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344560]  {CVE-2025-54518}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.4.2.el10uek]" date="1778673600">- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39361451]  {CVE-2026-23270}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39361449]  {CVE-2026-23278}
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39361444]  {CVE-2026-31402}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-202.76.4.3.el10uek]" date="1779105600">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391434]  {CVE-2026-46333}</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-202.76.4.4.el10uek]" date="1779364800">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39420559]  {CVE-2026-46300} 
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39420559]</changelog>
</package>
<package pkgid="230e44ee0ac5bf168623810d2e8f8539d13e2a6d" name="kernel-uek-debug-modules" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="203.76.7.1.el10uek"/>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) [Orabug: 39227772] {CVE-2026-23309}
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) [Orabug: 39251164] {CVE-2026-31513}
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong) [Orabug: 39251169] {CVE-2026-31514}
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) [Orabug: 39262447] {CVE-2026-31552}
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) [Orabug: 39331678] {CVE-2026-43210}
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) [Orabug: 39331784] {CVE-2026-43238}
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N) [Orabug: 39300554] {CVE-2026-31693}
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) [Orabug: 39331889] {CVE-2026-43264}
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) [Orabug: 39331303] {CVE-2026-43123}
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) [Orabug: 39331577] {CVE-2026-43186}
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) [Orabug: 39339241] {CVE-2026-43178}
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) [Orabug: 39343623] {CVE-2026-43318}
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) [Orabug: 39331924] {CVE-2026-43273}
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N) [Orabug: 39331696] {CVE-2026-43215}
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) [Orabug: 39331680] {CVE-2026-43211}
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) [Orabug: 39331661] {CVE-2026-43206}
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) [Orabug: 39331512] {CVE-2026-43170}
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) [Orabug: 39331937] {CVE-2026-43275}
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) [Orabug: 39331435] {CVE-2026-43150}
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) [Orabug: 39331422] {CVE-2026-43147}
- kexec: derive purgatory entry from symbol (Li Chen) [Orabug: 39343538] {CVE-2026-43289}
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao) [Orabug: 39331504] {CVE-2026-43168}
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) [Orabug: 39331827] {CVE-2026-43248}
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) [Orabug: 39343546] {CVE-2026-43292}
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) [Orabug: 39331482] {CVE-2026-43163}
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) [Orabug: 39331693] {CVE-2026-43214}
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) [Orabug: 39331458] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) [Orabug: 39331580] {CVE-2026-43187}
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) [Orabug: 39331409] {CVE-2026-43143}
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) [Orabug: 39331341] {CVE-2026-43130}
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) [Orabug: 39331444] {CVE-2026-43153}
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) [Orabug: 39331510] {CVE-2026-43169}
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) [Orabug: 39331358] {CVE-2026-43133}
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) [Orabug: 39331954] {CVE-2026-43278}
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) [Orabug: 39331545] {CVE-2026-43177}
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) [Orabug: 39331821] {CVE-2026-43246}
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) [Orabug: 39331705] {CVE-2026-43218}
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) [Orabug: 39331366] {CVE-2026-43135}
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) [Orabug: 39331866] {CVE-2026-43257}
- media: radio-keene: fix memory leak in error path (Shaurya Rane) [Orabug: 39331752] {CVE-2026-43231}
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) [Orabug: 39331370] {CVE-2026-43136}
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack) [Orabug: 39331846] {CVE-2026-43251}
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack) [Orabug: 39331389] {CVE-2026-43140}
- HID: hid-pl: handle probe errors (Oliver Neukum) [Orabug: 39331440] {CVE-2026-43152}
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) [Orabug: 39343613] {CVE-2026-43315}
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) [Orabug: 39331353] {CVE-2026-43132}
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) [Orabug: 39331023] {CVE-2025-71286}
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) [Orabug: 39331012] {CVE-2025-71274}
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) [Orabug: 39331761] {CVE-2026-43233}
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski) [Orabug: 39331606] {CVE-2026-43194}
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) [Orabug: 39331628] {CVE-2026-43199}
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) [Orabug: 39331331] {CVE-2026-43128}
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) [Orabug: 39331449] {CVE-2026-43156}
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) [Orabug: 39331361] {CVE-2026-43134}
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi) [Orabug: 39331875] {CVE-2026-43260}
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) [Orabug: 39331549] {CVE-2026-43180}
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) [Orabug: 39331496] {CVE-2026-43167}
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) [Orabug: 39331383] {CVE-2026-43139}
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) [Orabug: 39331959] {CVE-2026-43279}
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) [Orabug: 39343626] {CVE-2026-43319}
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [Orabug: 39343577] {CVE-2026-43304}
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) [Orabug: 39331591] {CVE-2026-43190}
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) [Orabug: 39343531] {CVE-2026-43288}
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) [Orabug: 39331853] {CVE-2026-43253}
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) [Orabug: 39331859] {CVE-2026-43255}
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui) [Orabug: 39343609] {CVE-2026-43314}
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) [Orabug: 39331003] {CVE-2025-71273}
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) [Orabug: 39343515] {CVE-2025-71297}
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) [Orabug: 39331318] {CVE-2026-43126}
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) [Orabug: 39331375] {CVE-2026-43137}
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan) [Orabug: 39343527] {CVE-2026-43287}
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) [Orabug: 39331585] {CVE-2026-43189}
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook) [Orabug: 39343616] {CVE-2026-43316}
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) [Orabug: 39331719] {CVE-2026-43223}
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) [Orabug: 39331807] {CVE-2026-43243}
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu) [Orabug: 39343628] {CVE-2026-43320}
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) [Orabug: 39331070] {CVE-2025-71294}
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) [Orabug: 39331308] {CVE-2026-43124}
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) [Orabug: 39343581] {CVE-2026-43306}
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) [Orabug: 39331918] {CVE-2026-43271}
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) [Orabug: 39343603] {CVE-2026-43313}
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) [Orabug: 39331896] {CVE-2026-43266}
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) [Orabug: 39331636] {CVE-2026-43201}
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) [Orabug: 39331947] {CVE-2026-43277}
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) [Orabug: 39331518] {CVE-2026-43171}
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) [Orabug: 39331877] {CVE-2026-43261}
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho) [Orabug: 39331789] {CVE-2026-43239}
- gfs2: fiemap page fault fix (Andreas Gruenbacher) [Orabug: 39331882] {CVE-2026-43262}
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) [Orabug: 39331312] {CVE-2026-43125}
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) [Orabug: 39331077] {CVE-2025-71295}
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan)
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan)
- apparmor: fix aa_label to return state from compount and component match (John Johansen)
- apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
- apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu)
- apparmor: make label_match return a consistent value (John Johansen)
- apparmor: remove apply_modes_to_perms from label_match (John Johansen)
- apparmor: fix rlimit for posix cpu timers (John Johansen)
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee)
- apparmor: Fix &amp; Optimize table creation from possibly unaligned memory (Helge Deller)
- AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller)
- apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu)
- net/mlx5: Fix multiport device check over light SFs (Shay Drory)
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
- octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam)
- icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273}
- ping: annotate data-races in ping_lookup() (Eric Dumazet)
- bpftool: Fix truncated netlink dumps (Jakub Kicinski)
- ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
- net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
- ipvs: do not keep dest_dst if dev is going down (Julian Anastasov)
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko)
- selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
- net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov)
- xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
- net: usb: catc: enable basic endpoint checking (Ziyi Guo)
- net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon)
- ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima)
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo)
- net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo)
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo)
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon)
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
- cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can)
- objpool: fix the overestimation of object pooling metadata size (Zhouwenhao)
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski)
- kbuild: Add objtool to top-level clean target (Josh Poimboeuf)
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan)
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
- fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
- fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik)
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe)
- drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder)
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas)
- backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán)
- backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
- leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang)
- pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
- iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
- ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
- usb: bdc: fix sleep during atomic (Justin Chen)
- drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko)
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder)
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei)
- mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski)
- mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
- phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard)
- coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
- watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi)
- iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan)
- iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan)
- iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan)
- iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan)
- iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan)
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
- serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
- serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
- staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
- iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap)
- soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann)
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa)
- dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
- interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli)
- interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli)
- clk: mediatek: Fix error handling in runtime PM setup (Xu Wang)
- clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger)
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
- clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
- clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem)
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona)
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
- clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy)
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
- fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu)
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
- tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin)
- fs/nfs: Fix readdir slow-start regression (Sagi Grimberg)
- nvdimm: virtio_pmem: serialize flush requests (Li Chen)
- scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
- scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann)
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan)
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett)
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed)
- mtd: spinand: Fix kernel doc (Miquel Raynal)
- mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
- cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang)
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
- RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian)
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan)
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
- NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer)
- nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer)
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan)
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello)
- crypto: ccp - Add an S4 restore flow (Mario Limonciello)
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello)
- platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K)
- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin)
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
- IB/mlx5: Fix port speed query for representors (Or Har-Toov)
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas)
- tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout)
- RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni)
- RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
- RDMA/rtrs-srv: fix SG mapping (Roman Pen)
- power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
- RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
- RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang)
- RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang)
- IB/cache: update gid cache on client reregister event (Etienne Aujames)
- RDMA/rtrs: server: remove dead code (Lihonggang)
- octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
- octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar)
- octeon_ep: disable per ring interrupts (Vimlesh Kumar)
- serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen)
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev)
- net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev)
- net: sunhme: Fix sbus regression (René Rebe)
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411}
- smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher)
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
- net: hns3: fix double free issue for tx spare buffer (Jian Shen)
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari)
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso)
- netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn)
- netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
- netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal)
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell)
- nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet)
- bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
- mptcp: fix receive space timestamp initialization (Paolo Abeni)
- of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li)
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
- ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek)
- selftests/mm: convert page_size to unsigned long (Siddarth G)
- selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum)
- PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
- PCI: Add defines for bridge window indexing (Ilpo Järvinen)
- PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
- wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov)
- tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
- fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
- nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
- xdrgen: Initialize data pointer for zero-length items (Chuck Lever)
- NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever)
- xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever)
- dm: use bio_clone_blkg_association (Mikulas Patocka)
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu)
- iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu)
- iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu)
- iommu/vt-d: Separate page request queue from SVM (Joel Granados)
- iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek)
- module: add helper function for reading module_buildid() (Petr Mladek)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal)
- netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
- netfilter: nf_tables: reset table validation state on abort (Florian Westphal)
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
- mctp i2c: initialise event handler read bytes (Matt Johnston)
- net: mctp-i2c: fix duplicate reception of old data (Jian Zhang)
- quota: fix livelock between quotactl and freeze_super (Abhishek Bapat)
- dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka)
- dm: fix unlocked test for dm_suspended_md (Mikulas Patocka)
- PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
- PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
- Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue)
- Documentation: trace: Refactor toctree (Purva Yeshi)
- docs: fix WARNING document not included in any toctree (Surajsonawane2415)
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao)
- wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming)
- PCI/PM: Avoid redundant delays on D3hot-&gt;D3cold (Brian Norris)
- Documentation: PCI: endpoint: Fix ntb/vntb copy &amp; paste errors (Baruch Siach)
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
- hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee)
- hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki)
- hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki)
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck)
- spi: tools: Add include folder to .gitignore (Francesco Lavra)
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin)
- platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
- drm/xe: Unregister drm device on probe error (Shuicheng Lin)
- evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu)
- media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
- platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko)
- drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak)
- drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov)
- media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov)
- drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov)
- HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
- regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
- drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov)
- drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin)
- drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P)
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
- drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam)
- drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello)
- media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan)
- ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea)
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea)
- ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea)
- smack: /smack/doi: accept previously used values (Konstantin Andreev)
- smack: /smack/doi must be &gt; 0 (Konstantin Andreev)
- drm/panthor: Evict groups before VM termination (Ketil Johnsen)
- ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: Relax __free() variable declarations (Takashi Iwai)
- ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang)
- drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger)
- workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan)
- workqueue: Only assign rescuer work when really needed (Lai Jiangshan)
- workqueue: Factor out assign_rescuer_work() (Lai Jiangshan)
- drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon)
- drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon)
- drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon)
- drm/panthor: Fix the group priority rotation logic (Boris Brezillon)
- drm/panthor: Fix the full_tick check (Boris Brezillon)
- drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon)
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio)
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek)
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov)
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov)
- arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
- arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
- arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet)
- hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang)
- arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha)
- arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha)
- arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet)
- arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet)
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno)
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan)
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
- powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy)
- arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa)
- arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
- clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
- arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein)
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein)
- firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla)
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
- soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz)
- pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
- hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang)
- hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell)
- crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan)
- fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville)
- sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
- sched/deadline: Clear the defer params (Joel Fernandes)
- media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
- EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior)
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior)
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon)
- crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang)
- crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
- x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa)
- x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa)
- tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu)
- tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu)
- fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu)
- ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu)
- ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu)
- ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt)
- ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt)
- tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu)
- bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen)
- bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen)
- crypto: ccp - narrow scope of snp_range_list (Tycho Andersen)
- crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra)
- hrtimer: Fix trace oddity (Thomas Gleixner)
- selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi)
- bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan)
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao)
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang)
- crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
- crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
- libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
- selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan)
- crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu)
- perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
- cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian)
- perf: arm_spe: Properly set hw.state on failures (Leo Yan)
- PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
- md/raid1: fix memory leak in raid1_run() (Zilin Guan)
- md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing)
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné)
- ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan)
- thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu)
- iomap: fix submission side handling of completion side errors (Christoph Hellwig)
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu)
- OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov)
- md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
- md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai)
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki)
- cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki)
- io_uring/sync: validate passed in offset (Jens Axboe)
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov)
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander)
- xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie)
- rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller)
- rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig)
- block: add a bio_add_virt_nofail helper (Christoph Hellwig)
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara)
- btrfs: fix block_group_tree dirty_list corruption (Boris Burkov)
- btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
- erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang)
- erofs: get rid of raw bi_end_io() usage (Gao Xiang)
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
- i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan)
- i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom)
- gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
- gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher)
- gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher)
- i3c: master: Update hot-join flag only on success (Adrian Hunter)
- fs: add &lt;linux/init_task.h&gt; for 'init_fs' (Ben Dooks)
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks)
- rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai)
- rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang)
- rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes)
- hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
- auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
- RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243}
- RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.2.el10uek]" date="1776168000">- ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 38649060,39186444,39202432] {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet) [Orabug: 38887740,39181101,39202431] {CVE-2026-23004}
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera) [Orabug: 39029337,39131054] {CVE-2026-23381}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe) [Orabug: 39144150,39343763] {CVE-2026-43366}
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao) [Orabug: 38970584,39166116] {CVE-2026-23207}
- spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Add support for internal DMA (Vishwaroop A) [Orabug: 39166116]
- spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A) [Orabug: 39166116]
- iommufd/device: Add helper to detect the first attach of a group (Yi Liu) [Orabug: 39166116]
- iommufd/device: Replace idev-&gt;igroup with local variable (Yi Liu) [Orabug: 39166116]
- iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu) [Orabug: 39166116]
- iommufd: Pass @pasid through the device attach/replace path (Yi Liu) [Orabug: 39166116]
- iommu: Drop iommu_group_replace_domain() (Yi Liu) [Orabug: 39166116]
- arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski) [Orabug: 39166116]</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.1.el10uek]" date="1776772800">- Revert "EDAC: Octeon: Init SDEI" (Jeremy Tang) [Orabug: 39203407]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.2.el10uek]" date="1777464000">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman) [Orabug: 39276980]
- uek-rpm/config-aarch64: Enable NVIDIA-recommended Vera-Rubin configs (Vijay Kumar) [Orabug: 39157707]
- kselftest/arm64: Add HWCAP test for FEAT_LS64 (Yicong Yang) [Orabug: 39157707]
- arm64: Provide basic EL2 setup for FEAT_{LS64, LS64_V} usage at EL0/1 (Yicong Yang) [Orabug: 39157707]
- perf: arm_spe: Relax period restriction (Leo Yan) [Orabug: 39157707]
- perf/arm_cspmu: Add PMEVFILT2R support (Robin Murphy) [Orabug: 39157707]
- ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional (Lifeng Zheng) [Orabug: 39157707]
- dt-bindings: gpio: Add Tegra256 support (Prathamesh Shete) [Orabug: 39157707]
- perf/arm_cspmu: nvidia: Add revision id matching (Besar Wicaksono) [Orabug: 39157707]
- arm64: Handle BRBE booting requirements (Anshuman Khandual) [Orabug: 39157707]
- arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again (Rob Herring) [Orabug: 39157707]
- arm64/gcs: Provide basic EL2 setup to allow GCS usage at EL0 and EL1 (Mark Brown) [Orabug: 39157707]
- tools headers arm64: Add NVIDIA Olympus part (Besar Wicaksono) [Orabug: 39157707]
- perf arm-spe: Add NVIDIA Olympus to neoverse list (Besar Wicaksono) [Orabug: 39157707]
- perf arm_spe: Add CPU variants supporting common data source packet (Leo Yan) [Orabug: 39157707]
- arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Yicong Yang) [Orabug: 39157707]
- perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Yicong Yang) [Orabug: 39157707]
- perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions (Yicong Yang) [Orabug: 39157707]
- perf/arm_cspmu: nvidia: Add pmevfiltr2 support (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Add pmpidr support (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Move register definitons to header (Robin Murphy) [Orabug: 39157707]
- perf/arm_cspmu: Add callback to reset filter config (Besar Wicaksono) [Orabug: 39157707]
- perf/arm_cspmu: Generalise event filtering (Robin Murphy) [Orabug: 39157707]
- perf: arm_pmuv3: Add support for the Branch Record Buffer Extension (BRBE) (Rob Herring) [Orabug: 39157707]
- arm64/sysreg: Add BRBE registers and fields (Anshuman Khandual) [Orabug: 39157707]
- perf: arm_pmu: Move PMUv3-specific data (Mark Rutland) [Orabug: 39157707]
- perf: apple_m1: Don't disable counter in m1_pmu_enable_event() (Rob Herring) [Orabug: 39157707]
- perf: arm_v7_pmu: Don't disable counter in (armv7|krait_|scorpion_)pmu_enable_event() (Rob Herring) [Orabug: 39157707]
- perf: arm_v7_pmu: Drop obvious comments for enabling/disabling counters and interrupts (Rob Herring) [Orabug: 39157707]
- perf: arm_pmuv3: Don't disable counter in armv8pmu_enable_event() (Mark Rutland) [Orabug: 39157707]
- ACPI: CPPC: Rename EPP constants for clarity (Sumit Gupta) [Orabug: 39157707]
- ACPI: CPPC: Add three functions related to autonomous selection (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel() (Lifeng Zheng) [Orabug: 39157707]
- cpufreq/amd-pstate: Store the boost numerator as highest perf again (Mario Limonciello) [Orabug: 39157707]
- ACPI: CPPC: Refactor register value get and set ABIs (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Add cppc_set_reg_val() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Extract cppc_get_reg_val_in_pcc() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Optimize cppc_get_perf() (Lifeng Zheng) [Orabug: 39157707]
- ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu() (Jie Zhan) [Orabug: 39157707]
- ACPI: CPPC: Clean up cppc_perf_caps and cppc_perf_ctrls structs (Sumit Gupta) [Orabug: 39157707]
- cpufreq: CPPC: Add generic helpers for sysfs show/store (Sumit Gupta) [Orabug: 39157707]
- cpufreq: CPPC: Add support for autonomous selection (Lifeng Zheng) [Orabug: 39157707]
- PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (Nirmoy Das) [Orabug: 39157707]
- PCI: Add ASPEED vendor ID to pci_ids.h (Nirmoy Das) [Orabug: 39157707]
- i2c: tegra: Add support for SW mutex register (Kartik) [Orabug: 39157707]
- i2c: tegra: Use internal reset when reset property is not available (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add HS mode support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Update Tegra256 timing parameters (Akhil R) [Orabug: 39157707]
- i2c: tegra: Use separate variables for fast and fastplus (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add Tegra264 support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Add Tegra256 support (Akhil R) [Orabug: 39157707]
- i2c: tegra: Do not configure DMA if not supported (Kartik) [Orabug: 39157707]
- gpio: tegra186: Fix GPIO name collisions for Tegra410 (Kartik) [Orabug: 39157707]
- gpio: tegra186: Use generic macro for port definitions (Kartik) [Orabug: 39157707]
- gpio: tegra186: Add support for Tegra410 (Prathamesh Shete) [Orabug: 39157707]
- gpio: tegra186: Add support for Tegra256 (Prathamesh Shete) [Orabug: 39157707]
- arm64: acpi: Enable ACPI CCEL support (Suzuki K Poulose) [Orabug: 39157707]
- arm64: Enable EFI secret area Securityfs support (Suzuki K Poulose) [Orabug: 39157707]
- arm64: realm: ioremap: Allow mapping memory as encrypted (Suzuki K Poulose) [Orabug: 39157707]
- arm64: Document Arm Confidential Compute (Steven Price) [Orabug: 39157707]
- virt: arm-cca-guest: TSM_REPORT support for realms (Sami Mujawar) [Orabug: 39157707]
- arm64: Enable memory encrypt for Realms (Suzuki K Poulose) [Orabug: 39157707]
- arm64: mm: Avoid TLBI when marking pages as valid (Steven Price) [Orabug: 39157707]
- arm64: Enforce bounce buffers for realm DMA (Steven Price) [Orabug: 39157707]
- efi: arm64: Map Device with Prot Shared (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Map unprotected MMIO as decrypted (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Add support for checking whether an MMIO is protected (Suzuki K Poulose) [Orabug: 39157707]
- arm64: realm: Query IPA size from the RMM (Steven Price) [Orabug: 39157707]
- arm64: Detect if in a realm and set RIPAS RAM (Suzuki K Poulose) [Orabug: 39157707]
- arm64: rsi: Add RSI definitions (Suzuki K Poulose) [Orabug: 39157707]
- PCI/TPH: Add TPH documentation (Wei Huang) [Orabug: 39157707]
- PCI/TPH: Add Steering Tag support (Wei Huang) [Orabug: 39157707]
- PCI: Add TLP Processing Hints (TPH) support (Wei Huang) [Orabug: 39157707]
- sched: Update rq-&gt;avg_idle when a task is moved to an idle CPU (Shubhang Kaushik) [Orabug: 39214522]
- arm64: mte: Set TCMA1 whenever MTE is present in the kernel (Carl Worth) [Orabug: 39214522]
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov) [Orabug: 39241227,39273721] {CVE-2026-31628}
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp) [Orabug: 39252919]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp) [Orabug: 39259550]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.3.el10uek]" date="1777982400">- sched/deadline: Use revised wakeup rule for dl_server (Peter Zijlstra)
- netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [Orabug: 39339273] {CVE-2026-43084}
- netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -&gt; GFP_KERNEL_ACCOUNT allocation (Scott Mitchell)
- Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt" (Sasha Levin)
- Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads" (Sasha Levin)
- iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() (Zhen Ni) [Orabug: 39145066]
- iommu/amd: Fix header file (Vasant Hegde) [Orabug: 39145066]
- iommu/amd: Preserve default DTE fields when updating Host Page Table Root (Alejandro Jimenez) [Orabug: 39145066]
- iommu/amd: Enable support for up to 2K interrupts per function (Kishon Vijay Abraham I) [Orabug: 39145066]
- iommu/amd: Rename DTE_INTTABLEN* and MAX_IRQS_PER_TABLE macro (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Replace slab cache allocator with page allocator (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Introduce generic function to set multibit feature value (Sairaj Kodilkar) [Orabug: 39145066]
- iommu/amd: Remove amd_iommu_apply_erratum_63() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Lock DTE before updating the entry with WRITE_ONCE() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Modify clear_dte_entry() to avoid in-place update (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce helper function get_dte256() (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Modify set_dte_entry() to use 256-bit DTE helpers (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce helper function to update 256-bit DTE (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Introduce struct ivhd_dte_flags to store persistent DTE flags (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported (Suravee Suthikulpanit) [Orabug: 39145066]
- iommu/amd: Misc ACPI IVRS debug info clean up (Suravee Suthikulpanit) [Orabug: 39145066]
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39250685,39331108] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [Orabug: 39250685]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug: 39250685,39300909] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250685]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le) [Orabug: 39250685]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug: 39250685,39283866,39291972,39292190] {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250685]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers) [Orabug: 39250685]
- iommu/arm-smmu-v3: Handle zeroed A4-2C HTTU override settings (Joao Martins) [Orabug: 39260974]</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.4.el10uek]" date="1778587200">- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39218893]  {CVE-2025-54518}
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39334587]  {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39334587]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39334587]
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39334587]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39334587]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39334587]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39334587]  {CVE-2026-43284}
- bcm-hsdk-gpl: Fix build issues for HSDK 6.5.34 (Vijay Kumar)  [Orabug: 39342234]
- bcm-hsdk-gpl: Update BCM HSDK GPL driver to 6.5.34 (Vijay Kumar)  [Orabug: 39342234]
- minke-fan-cpld: Avoid logging 'unknown fan id' when no fan is present (arista-hpandya)  [Orabug: 39335238]
- exadata: tools: perf: update column to comm_nodigit (Stephen Brennan)  [Orabug: 39327035]
- perf report: Add comm_nodigit sort key (Stephen Brennan)  [Orabug: 39327035]
- Revert "tools: perf: add comm_ignore_digit column" (Stephen Brennan)  [Orabug: 39327035]
- octeontx2-af: cn20k: Fix RVU AF interrupt handler (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Move QMEM allocations from GFP_KERNEL to ATOMIC (Sunil Goutham)  [Orabug: 39318904]
- bphy-pf: CNF20Ka: poll MHABs based on cpri_mask instead of fixed count (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: Add devlink param for NIX RQ caching (Nishok A)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix the RVUAF-&gt;PF mbox address (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add devlink and debugfs support for NPA DWRR registers. (Anshumali Gaur)  [Orabug: 39318904]
- cn20k-af: psw: Fix build warning (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix AI review comments. (Ratheesh Kannoth)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox to write to PSW MSIX registers (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add debugfs support for psw (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: introduce a mailbox to program PSW mbox msix vector (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add PSW AF API Notification queue support (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add FLR handler for PSW (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setup PSW timed polling structure tables (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW PCIe configuration (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW LF mapping (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add new mailbox for PSW doorbell configuration (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setups PSW FID resources (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: setup PSW GID resources (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: add mailbox to get PSW capabilities (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: register PSW AF interrupts (Srujana Challa)  [Orabug: 39318904]
- cn20k-af: psw: introduce PSW block (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: limit max periodic timers for cn20k (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Make default entries as x4. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeonxt2-af: npc: Fix bugs (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2_unregister_dl() after kernel reboot. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2vf_remove after kernel reboot. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: cn20k: Configure default CPT_AF_UCC_CTL for IPsec error codes (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: CN20k: add support for RFOE4 on half MP (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: Fix kernel crash during eswitch creation (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Use ZERO_OR_NULL_PTR for cgxchan2link_map (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add parser configuration for VLAN extraction (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support for single SBTAG parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix SDP channel base (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add MCS DSA tag parsing configuration support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Avoid any false positives for Altaf (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npc: Fix broadcast MCAM entry type on CN10K (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add platform check. (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-bphy-netdev: add get_link_ksettings to fix SIOCETHTOOL error (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: dont free default mcam indexes (Ratheesh Kannoth)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Replace deprecated MSI-X API in CPRI netdev driver (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix kernel warn. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Mismatch stats. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Dont free PF default mcam indexes. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: FIx invalid access (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: dstats (Ratheesh Kannoth)  [Orabug: 39318904]
- octeonxt2-af: npc: cn20k: show enable/disable status. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: debugfs for virtual indexes (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix AI reviews (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Alloc default indexes during nix lf alloc (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix default mcam idx free (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: Remove SoC specific local variables. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix SC resource cleanup loop (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs: Add SC CAM bypass entry (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Modify the pcifunc VF mask (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: update the AFPFX_TRIGX reg offset (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: Fix rvu mbox registers offset (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2: sdp: Display backpressure status in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: add bounds check in nix_bp_enable (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: cn20k: Set a default value for res_meta_offset (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: Support mapping of individual slots to RVU block LFs (Subbaraya Sundeep)  [Orabug: 39318904]
- cn20k-af: ml: improve AF register access control (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: fetch list of LF IDs attached (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: fix using uninitialized partition ID (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable mapping LF to partition ID (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable mapping LF with partitions (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support ML lf alloc and free (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support fetching msix offset for ML (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: support attach and detach of ML LFs (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: add support to fetch ML capabilities (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: implement ML mbox message handler (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: register ML interrupt handlers (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: implement hw resource setup and free (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: enable ML block probe and remove (Srikanth Yalavarthi)  [Orabug: 39318904]
- cn20k-af: ml: add skeleton code for ML EB driver (Prince Takkar)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Add CN20K TX SecY policy bit support (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs: Set default mcs Id to 0. (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix memleak in npc_install flow (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix flags for HWWQE period timers (Mikko Suni)  [Orabug: 39318904]
- octeontx2-af: cn20k: Use physical address for AF-&gt;PF mbox (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: update fields of CPT_AF_LFX_CTL (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: cn20k: configure RX inline replay (Shashank Gupta)  [Orabug: 39318904]
- Octeontx2-af: cn20k: configure inline RQ mask (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Don't initialize ipsec queues for representor PF. (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-bphy-pf: CNF20ka: BPHY NIC PF driver for chiplet based BPHY NIX bypass mode (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: fix npc mbox structure defination (Mohit Kumar Parjapat)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Avoid SoC specific structures (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix get number of kw (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: cancel work before destroying wq. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx: switch: Fix compiler warnings. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: selftest: Use unique mbox ids (Linu Cherian)  [Orabug: 39318904]
- octeontx: pan: Disable WQ after unregister notifier (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Define new flag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix bugs. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Update mcam_idx for reply flow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Support ovs offloading (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Support mask as well for flow. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Pass tuple mask as well to flow. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Retrieve VLAN infor for L3 routing (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Add vlan tag as part of message (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Dont process events if switchdev is not up (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: make functions static (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix graceful shutdown. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Notify switchdev on NF table callback (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Support SNAT/DNAT routing (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Reject acceleration for invalid bridge (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switch: Fix buffer overflow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switch: Fix below kernel splat (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switchdev: Register for Route events. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switchdev: Forward route notifications. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: switchdev: Add driver support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: switchdev: L2 offload support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Remove devlink support for SDP VF NIC driver (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: Handle pool context address update in Aura context write (Ashwin Sekhar T K)  [Orabug: 39318904]
- octeontx2-af: CN20k: fix unused-function warning (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-pf: Move representor event handling into common file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix Rep link state sync up with PF/VFs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Fix DPC config mbox (Ashwin Sekhar T K)  [Orabug: 39318904]
- Octeontx2-pf: Fix transceiver details corruption (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: change GEN PF device ID (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20K: Fetch LBK supported channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix limiting SRIOV VF count logic (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: Fix KASAN slab-out-of-bounds error (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: Update irq affinity for mbox and flr (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add FLR/ME support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Fix possible memleak while mbox init (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Map alternative AF NIX_AF_GINT only for CN10K (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support to forward error interrupts to alt AF (Anil Kumar Reddy)  [Orabug: 39318904]
- octeontx2-af: Add support to forward flr to alternative AF (Anil Kumar Reddy)  [Orabug: 39318904]
- octeontx2-af: Update Alternative AF status (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: cn20k: Cleanup AF interrupt vector (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Do not hardcode AF bus number in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix rsrc_alloc debugfs file (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Add devlink option to reset MAC stats for debugging (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add devlink for defrag initiation (Ratheesh Kannoth)  [Orabug: 39318904]
- net: octeontx2: Fix coding style issues (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-af: Fix mcs string buffer size (Stefan Wiehler)  [Orabug: 39318904]
- octeontx2-af: Skip TM tree print for disabled SQs (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: debugfs: Add cn20k sdp rings info (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix kernel crash during NIX TM register dump (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: cpt: Add debug support for more than 64 engines. (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Update engine offset calculation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Add support to display "Autoneg" (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-vf: Set tc filter flag on vf netdev (Suman Ghosh)  [Orabug: 39318904]
- Octeontx2-pf: Update link mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-pf: Fix ethtool eeprom read logic (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: ethtool: Display physical connector type (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: restart interface when link settings are changed by user (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-sdpvf: Fix PTP options for SDP interfaces (Roy Franz)  [Orabug: 39318904]
- octeontx2-vf: Add partial ethtool support for SDP VFs (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Add page pool stats to ethtool (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Add missing changes in otx2_ethtool.c (Suman Ghosh)  [Orabug: 39318904]
- Octeontx2-pf: tc: fix egress ratelimiting (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Support to enable EDSA/Higig2 pkts parsing (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Using compound/head page ref count (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Fix NDC sync operation errors (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: cn20k: fix target address (Juan Garcia)  [Orabug: 39318904]
- octeontx2-pf: Check address for Null before free (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Add soft reset sequence in mcs_global_cfg() (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-pf: mcs: Don't account field alignment when installing TX SecY policy (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix start and end bit for scan config (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: npc: cn20k: Remove function (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: npc: cn20k: refactor code (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cgx: misc changes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: reset TL1 SW_XOFF before returning from link mode change (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Remove MAC address validation check (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Show count of dropped packets by DMAC filters (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Update mbox version (Sunil Goutham)  [Orabug: 39318904]
- cn10k-ipsec: Fix compilation with XFRM_OFFLOAD enabled (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-vf: Register dummy netdev for host PF VFs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Configure SQ default channel based on UP message (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Dereference only a valid pointer (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-vf: Fix VF mbox up message error on PTP RX enable (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: Add support for creating netdev interfaces for SDP VFs (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Add more debug messages (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Send UP messages to VF only when VF is up. (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Avoid null pointer dereference (Subbaraya Sundeep)  [Orabug: 39318904]
- cn10k-ipsec: fix uninitialized send queue during ESP offload (Shashank Gupta)  [Orabug: 39318904]
- cn10k-ipsec: Initialize ipsec queues on enabling IPsec (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: cn10k/cn20k: Update count_eot in NPA_LF_AURA_BATCH_FREE0 (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: persist netdev stats across routine operations (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-pf: Add self test (Linu Cherian)  [Orabug: 39318904]
- octeontx2-pf: Add ethtool -m option support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Skip dma map and unmap when IOMMU is bypassed (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-pf: Add NIXLF error/poison interrupt handlers (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-pf: Validation for TL1 Round robin priority (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: devlink param support to modify physical interface links. (Rakesh Babu)  [Orabug: 39318904]
- octeontx2-pf: Add devlink param to vary rbuf size (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Add devlink param to vary cqe size (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: CN20k: add multi chiplet support to NIX path (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Enable TX PTP timestamping on BPHY NIX link (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cn10k: Fix accessing invalid CSRs (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: fix fwdata NULL pointer dereference when RPM probe fails (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Map BPHY chiplet RPMs followed by compute chiplet RPMs (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k: Add chiplet RPM AF mbox support for port ready, get channel info messages. (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cnf20k: account for XCB RPM links in CGX link calculation (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Add support for chiplet based BPHY RPM driver as AF RVU extension block module (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Add BPHY chiplet, RPM, LMAC data to fwdata (Sai Krishna)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Register driver with PCI subsys ID (Anshumali Gaur)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Fix MSI-X init failure by setting both DMA masks (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20K: Add build and config support for CPRI PF driver to avoid module conflicts (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Fix CPRI MSI-X initialization failure (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Add workaround for gpint issue for CPRI pkt path (Viswajith Murali)  [Orabug: 39318904]
- bphy-pf: CNF20ka: Add cpri netdev driver support (Viswajith Murali)  [Orabug: 39318904]
- octeontx-bphy-netdev: Fix unexpected packet in netdev by ensuring proper PSW hardware write handling (Viswajith Murali)  [Orabug: 39318904]
- octeontx2-bphy-netdev: allow forcing ts steps cnt (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix fec counters reporting (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix ecpri pkt stats update (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix ecpri type5 handling (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix a deadlock in cpri (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix race condition for timestamp packets (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix kernel crash by using proper max PSM queue count (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: protect psm queue access (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix debugfs memleak (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Detect DL circular buffer full (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-bphy-netdev: fix rsfec stats reading (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Support for eCPRI MsgType5 timestamping (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Use correct netdev priv structure for debugging (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: disable CPRI RX on cleanup (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: ignore mcs untagged error (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: disable rx on RFOEs on exit (Baha Mesleh)  [Orabug: 39318904]
- octeontx2-bphy-netdev: Fix crash issue during initialization of cpri, rfoe interfaces on set MAC address (Sai Krishna)  [Orabug: 39318904]
- octeontx2-bphy-netdev: OcteonTX2 Base PHY RFOE netdev driver (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver msix, interrupt handling (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Move DPI block reset handling to AF extension block driver (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver channel table mbox support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver mbox support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k DPI AF driver initial support (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: cn20k: Don't reset the PF_DISC register (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: CN20K: update RPM links (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add block discovery register (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix PTP RX enable mbox fail issue over NIC VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: Modify NIX register offset value for CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Validate NIX maximum LFs correctly (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Fix incorrect BPID initialization for CPT channels (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow CPT PF access to CPT_AF_GRPX_THR (Shashank Gupta)  [Orabug: 39318904]
- octeontx2-af: cn20k: support packet data buffer (pdb) configuration (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Set LBK channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix config parameter check when disable inline queue (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable CPT parse and Frag info header byte swap (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Add an MCAM entry to count CPT 2nd pass miss packets (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: support overriding aura to zero for second pass (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Use proper mask to get max CPT LF's (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: allow mbox access from CPT VFs for backward compatibility (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: Drop CPT PF/VF check for relevant mboxes (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Change CPT channels configuration (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow CPT PF access to CPTX_AF_CTX_PSP_TIMER_CTL (Shashank Gupta)  [Orabug: 39318904]
- octeontx2-af: cn20k: change CPT register address as per latest csr (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Allow access to CPT_AF_UCCX_CTL (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: CN20K channel configuration (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable RXC on inline inbound cptlf (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix RXC flush and cleanup sequence (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add CPT CTX flush support (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: fix CPT ctx flush (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: cn20k: Setup CPT reassembly Queue Configuration Register (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Move RXC specific functions (Tanmay Jagdale)  [Orabug: 39318904]
- octeontx2-af: cn20k: handle multi-queue reassembly teardown (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for NIX RX inline configuration (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for CPT RX inline configuration (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for CPT RX queue allocation (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mbox to configure rx inline nixlf (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mbox to configure rx inline profile (Bharat Bhushan)  [Orabug: 39318904]
- crypto: octeontx2: Add new mailbox to set queue priority (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add rxc teardown support (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add queue id to rxc time config mbox (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add cpt stats mailbox support (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: add FLT interrupts (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx2-af: Unify HW interrupt APIs (Amit Singh Tomar)  [Orabug: 39318904]
- octeontx-af: cpt: Get CPT PF number using PF Device ID (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: cpt: Update max engine calculation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Add TC rules support for CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Set correct sequence for carrier off and tx queue stop (Suman Ghosh)  [Orabug: 39318904]
- octeontx2: Fix klockwork issues. (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Free queue memory allocated sq timestamp (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: Check for DMAC extraction support before setting DMAC based hardware filter for a VF (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Move REP devlink APIs to separate file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Fix representor up notification events (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Use ews_rules value to update REP tcam rules (Geetha sowjanya)  [Orabug: 39318904]
- Octeontx2-af: Change args for rvu_get_pf (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add validation before accessing fwdata (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: map management port always to first PF (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: replace generic error codes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: link mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Assign CGX id from PCI revision id (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Remove MAC address validation check (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: lmac validation with is_lmac_valid (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix compilation warning/klockwork issues (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: configure 802.3 pause frames in SGMII/QSGMII mode (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add new CGX_CMDs to set and get PHY modulation type (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Do not allow VFs to overwrite PKIND config (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Put CGX LMAC also in Higig2 mode (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-sdp: Add FLR interrupts for Host PFs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Refactor SDP interrupts code (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Fix SDP channel numbers in NPC rules (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: Check whether SDP block is present before access (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: sdp: Fix address range assignment logic (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: sdp: Maintain host to RVU GEN PF mapping (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-sdp: misc SDP fixes (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx-af: cn20k: Manage rings allocation and freeing (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: CN20K: SDP mbox framework (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: CN20K: SDP extension driver (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-pf: enable AF_XDP zero copy support (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix clearing TL3_TL2X_LINKX_CFG[ENA] during SMQ flush to drop packets (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Fix ROCEV2 RSS hashing QP ID length (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Allow to set CPT result address offset (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: cn20k: add mbox for NIX flow vector configuration (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: add ROCEv2 header for RSS hashing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Update lbk maximum frame size as per CN20K (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: fix TX scheduler count (Satha Rao)  [Orabug: 39318904]
- octeontx2-af: Fix the issue of infinite loop in nix_aq_reset (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Misc changes in NIX block (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Dump hw register state on error (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add new mailbox to configure LSO alt flags (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Extend SPI to SA index translation (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: notify VF about ptp event (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: Sending tsc value to the userspace (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: Support for PTP notification to PF (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: npa: fix DPC permit register access (Ashwin Sekhar T K)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add DPC support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add debugfs support for Halo (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: npa: cn20k: Add NPA Halo support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Fix number of entries in the kpu3 cam (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix subbank count (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix number of entries in the kpu2 cam (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add mbox to read default rule (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: kpu: Input validation check. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: kpu: Fix lodable profile issue (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Convert to C99 flexible array (Anshumali Gaur)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Restore stats in defrag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Flow delete and free mbox (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Add traces in NPC mailboxes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix KPU9 state variable for ROCEV2 (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add support for ROCEv2 header parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add more VLAN tag parsing in case of E-tag (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flags for cn20k (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Avoid updating cn10k registers during cn20k reboot (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Do not access match stats for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: Update NPC CSRs (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix out of bound access in entry2counter array (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix initialization of mcam's entry2target_pffunc field (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flag extraction in parse nibble (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix CPT CGX channel mask for cn20k (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: add changes to fragment flag in KPU profile for CN20K (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: fix mcam hit counter (Satheesh Paul)  [Orabug: 39318904]
- Revert "octeontx2-af: npc: cn20k: Get base steer rule index." (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: fix rule type for LBK VF (Rahul Bhansali)  [Orabug: 39318904]
- octeontx2-af: Fix failed to load custom pfl warning (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: add changes to update CPT pad length offset in KPU (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix search order (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: Use dev_dbg() (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Fix compilation warnings (Sunil Goutham)  [Orabug: 39318904]
- octeontx2: cn20k: npc: Set action2 for x2 entries. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cn20k: Enable action2 programming in npc (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Set default profile DYNAMIC (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix csr register field offset. (Satheesh Paul)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Reject request for x4 entries in x2 profile. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Alloc mcam entry for install flow (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Disable fw load faiure warning (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Load custom kpu profile from filesystem. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix install flow priority (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add support for custom mkex profiles (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Get base steer rule index. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Stats support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cn20k: Reject mcam alloc mbox with invalid keytype (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-pf: cn20k: Reserve x4 key mcam entries for ntuple (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Get kex related info from PF. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix parse result nibble mask reading. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: Set correct nibble bits for cn20k (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix parse nibble mask (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Avoid accessing cn10k registers (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add new mailboxes for CN20K silicon (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix npc_mcam_get_hit_status mbox for cn10k (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Convert vidx to mcam_idx in mbox handler (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add an mbox interface to defrag (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: defragmentation support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Introduce virtual mcam index (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Validate mcam index before enable/disable (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Add new mailboxes to get kex config and free counts (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Use common APIs to read/write/copy/enable mcam entry (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Add a new mbox to read/write MCAM hit status (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: debugfs support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Use common APIs to alloc/free/get mcam index. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Allocate default mcam indexes. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Modify alloc entry mailbox (Suman Ghosh)  [Orabug: 39318904]
- ocetontx2-af: npc: cn20k: MKEX profile support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: KPM profile changes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Index management. (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2: Fix klockwork issues. (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: Fix Support of FDSA tag (George Cherian)  [Orabug: 39318904]
- octeontx2-af: Support for FDSA tag (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Adding changes to parse stacked VLANs (Kiran Kumar K)  [Orabug: 39318904]
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix issue with GRE parsing (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add support to parse more VLAN headers (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Fix issue with IPV6 GRE and multi VLAN (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add KPU changes to parse fabric path header (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Add few missing changes (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-af: allow second pass pkts via default ucast entry (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: suppress kpu profile loading warning (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: use cpt channel mask in flow install path (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: Add NPC support to filter GTP-U and GTP-C packets based on TEID (Suman Ghosh)  [Orabug: 39318904]
- octeontx2: cn20k: Assign unique MCS IDs based on PCI enumeration (Subrat Pandey)  [Orabug: 39318904]
- octeontx2-pf: Choose macsec encryption offload per packet (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: mcs: Use new SCI CAM in hardware (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: mcs: Fix mcs resources free on PF shutdown (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Add devlink parameter to toggle MCS bypass mode (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Display port mapped stats for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add MCS LMAC channel and count configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: mcs set mcs id and silicon check (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Fix mcs tx_sa_map API (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add mcs PN threshold support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: MCS add port configure APIs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20K: Add MCS parser configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix mcs register offsets (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: mcs: Fix unsupported secy stats read (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: cn20k: Add MCS support (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: mcs: Remove SA stats support (Ratheesh Kannoth)  [Orabug: 39318904]
- octeontx2-af: cnf10k-b: mcs: Fix stats reg address (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: rvu: enable mcs fips mailboxes (Ankur Dwivedi)  [Orabug: 39318904]
- octeontx2-af: mcs: add mailboxes for fips (Ankur Dwivedi)  [Orabug: 39318904]
- octeontx2-af: sso: clear all the sets on init (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: tim: add ring priority support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: update TIM interval support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: moderate SSO AF error interrupts (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: lower TIM bucket skip IRQ log level (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: remove GTI clock adjustment (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: update xaq aura offset (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: cn20k: cleanup SSO EVA on LF reset (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO HW info mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO AGGR config and stats mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add SSO EVA error interrupts (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: update masks for CN20K resources (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: Fixed compilation warnings (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: fix interval flag check (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add TIM hardware info mbox (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add TIM HWWQE mbox support (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: add mbox to capture counters (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: reveal only TIM params that are available (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: add TIM error af interrupt handlers (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: clear state on TIM ring disable (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: disable preemption when enabling TIM (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: account for cycle wraparound (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: prevent TIM register read reorder (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: fix arguments passed to XAQ aura deinit (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: debugfs: fix undefined SSO register access (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: update TIM adjust GTI errata silicons (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: update TIM adjust GTI errata silicons (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: add TIM adjust GTI errata workaround (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: cn10k: devlink params to configure TIM (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: TIM: Set conditional clock always on (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Apply relevant HW issue workarounds for 96xx B0 silicon (Sunil Goutham)  [Orabug: 39318904]
- octeontx2-af: Add SSO and TIM units support to the AF driver (Pavan Nikhilesh)  [Orabug: 39318904]
- octeontx2-af: enable rxc with lookaside cpt lf (Vidya Sagar Velumuri)  [Orabug: 39318904]
- octeontx2-af: fix issue with spitosa table teardown (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: fix cflags include paths (Wladislav Wiebe)  [Orabug: 39318904]
- octeontx2-af: Move out REE mbox messages (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add generic mbox handler for Eblock (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Use AF extension block interface (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add RVU AF extension block interface (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Introducing REE block for 98xx (Smadar Fuks)  [Orabug: 39318904]
- octeontx2-af: fix VF bringup affecting PF promiscous state (Harman Kalra)  [Orabug: 39318904]
- octeontx2-af: consider mode when using cpt base channel for bp (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: Update minimum receive frame size (Sathesh Edara)  [Orabug: 39318904]
- octeontx2-af: set default min and max rx len for CPT link (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-af: add NIX mbox message to get HW info (Shijith Thotton)  [Orabug: 39318904]
- octeontx2-af: fix inline inbound IPsec configuration (Srujana Challa)  [Orabug: 39318904]
- octeontx2-af: support for custom L2 header (Satheesh Paul A)  [Orabug: 39318904]
- octeontx2-af: fix to get different rq mask (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: poll for tx link credits before link mode change (Naveen Mamindlapalli)  [Orabug: 39318904]
- octeontx2-af: Handle physical link state change requests (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Add mbox to alloc/free BPIDs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Dynamically allocate bpids for CPT and LBK (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add support for SPI to SA index translation (Kiran Kumar K)  [Orabug: 39318904]
- octeontx2-af: Update HW workarounds for 96xx C0, 98xx and F95xx B0 chips (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add devlink support to configure TL1 RR_PRIO (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: add support for CPT second pass (Rakesh Kudurumalla)  [Orabug: 39318904]
- octeontx2-af: add new mbox to support sync cycle on rx path (Satha Rao)  [Orabug: 39318904]
- octeontx2-af: add support for changing vlan tpid (Nithin Dabilpuram)  [Orabug: 39318904]
- octeontx2-pf: Fix devm_kcalloc() error checking (Dan Carpenter)  [Orabug: 39318904]
- octeontx2-pf: Use new bandwidth profiles in receive queue (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Display new bandwidth profiles too in debugfs (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Accommodate more bandwidth profiles for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Initialize new NIX SQ context for cn20k (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Initialize cn20k specific aura and pool contexts (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Skip NDC operations for cn20k (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Extend debugfs support for cn20k NPA (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Add cn20k NPA block contexts (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Extend debugfs support for cn20k NIX (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Add cn20k NIX block contexts (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Simplify context writing and reading to hardware (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: convert to ndo_hwtstamp API (Vadim Fedorenko)  [Orabug: 39318904]
- Octeontx2-af: Fix pci_alloc_irq_vectors() return value check (Harshit Mogalapalli)  [Orabug: 39318904]
- Octeontx2-af: Fix missing error code in cgx_probe() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-pf: fix bitmap leak (Bo Sun)  [Orabug: 39318904]
- octeontx2-vf: fix bitmap leak (Bo Sun)  [Orabug: 39318904]
- octeontx2-af: Remove unused declarations (Yue Haibing)  [Orabug: 39318904]
- Octeontx2-af: Fix NIX X2P calibration failures (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-vf: Fix max packet length errors (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Broadcast XON on all channels (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: use unsigned int as iterator for unsigned values (Simon Horman)  [Orabug: 39318904]
- net: Fix typos (Bjorn Helgaas)  [Orabug: 39318904]
- Octeontx2-af: Debugfs support for firmware data (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: RPM: Update DMA mask (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Disable stale DMAC filters (Subbaraya Sundeep)  [Orabug: 39318904]
- Octeontx2-af: Add programmed macaddr to RVU pfvf (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix error code in rvu_mbox_init() (Dan Carpenter)  [Orabug: 39318904]
- Octeontx2-pf: ethtool: support multi advertise mode (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx2-af: Introduce mode group index (Hariprasad Kelam)  [Orabug: 39318904]
- Octeontx-pf: Update SGMII mode mapping (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Fix rvu_mbox_init return path (Subbaraya Sundeep)  [Orabug: 39318904]
- Octeontx2-pf: Fix Backpresure configuration (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: CN20K mbox implementation between PF-VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20K mbox implementation for AF's VF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-pf: CN20K mbox REQ/ACK implementation for NIC PF (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k mbox to support AF REQ/ACK functionality (Sai Krishna)  [Orabug: 39318904]
- octeontx2-af: CN20k basic mbox operations and structures (Sai Krishna)  [Orabug: 39318904]
- octeontx2: Set appropriate PF, VF masks and shifts based on silicon (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Avoid typecasts by simplifying otx2_atomic64_add macro (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Annotate mmio regions as __iomem (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: macsec: Get MACSEC capability flag from AF (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Add MACSEC capability flag (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Send Link events one by one (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: NPC: Clear Unicast rule on nixlf detach (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-pf: Avoid adding dcbnl_ops for LBK and SDP vf (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Add tracepoint for NIX_PARSE_S (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Add new tracepoint otx2_msg_status (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2: Add pcifunc also to mailbox tracepoints (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: Display names for CPT and UP messages (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-af: convert dev_dbg to tracepoint in mbox (Subbaraya Sundeep)  [Orabug: 39318904]
- octeontx2-pf: Fix ethtool support for SDP representors (Hariprasad Kelam)  [Orabug: 39318904]
- net: octeontx2: Use pure PCI devres API (Philipp Stanner)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP: code clean up (Hariprasad Kelam)  [Orabug: 39318904]
- octeontx2-af: Remove unused rvu_npc_enable_bcast_entry (Dr. David Alan Gilbert)  [Orabug: 39318904]
- xfrm: Add explicit dev to .xdo_dev_state_{add,delete,free} (Cosmin Ratiu)  [Orabug: 39318904]
- octeontx2-pf: handle otx2_mbox_get_rsp errors (Chenyuan Yang)  [Orabug: 39318904]
- net: octeontx2: Handle XDP_ABORTED and XDP invalid as XDP_DROP (Lorenzo Bianconi)  [Orabug: 39318904]
- octeontx2-af: mcs: Remove redundant 'flush_workqueue()' calls (Chen Ni)  [Orabug: 39318904]
- net: octeontx2: Add metadata support for xdp mode (Lorenzo Bianconi)  [Orabug: 39318904]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 39318904]
- octeontx2: hide unused label (Arnd Bergmann)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP zero copy transmit support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Prepare for AF_XDP (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: Reconfigure RSS table after enabling AF_XDP zerocopy on rx queue (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: AF_XDP zero copy receive support (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: use xdp_return_frame() to free xdp buffers (Suman Ghosh)  [Orabug: 39318904]
- octeontx2-pf: mcs: Remove dead code and semi-colon from rsrc_name() (Nihar Chaithanya)  [Orabug: 39318904]
- octeontx2-pf: fix error handling of devlink port in rvu_rep_create() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-pf: fix netdev memory leak in rvu_rep_create() (Harshit Mogalapalli)  [Orabug: 39318904]
- octeontx2-af: fix build regression without CONFIG_DCB (Arnd Bergmann)  [Orabug: 39318904]
- cn10k-ipsec: Fix compilation error when CONFIG_XFRM_OFFLOAD disabled (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Fix installation of PF multicast rule (Geetha sowjanya)  [Orabug: 39318904]
- cn10k-ipsec: Enable outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Allow ipsec crypto offload for skb with SA (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Process outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Add SA add/del support for outb ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- cn10k-ipsec: Init hardware for outbound ipsec crypto offload (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Disable backpressure between CPT and NIX (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: Move skb fragment map/unmap to common code (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-pf: map skb data as device writeable (Bharat Bhushan)  [Orabug: 39318904]
- octeontx2-af: Fix SDP MAC link credits configuration (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Fix spelling mistake "reprentator" -&gt; "representor" (Colin Ian King)  [Orabug: 39318904]
- octeontx2-pf: Adds TC offload support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Implement offload stats ndo for representors (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add devlink port support (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add representors for sdp MAC (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Configure VF mtu via representor (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add support to sync link state between representor and VFs (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Get VF stats via representor (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Add packet path between representor and VF (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add basic net_device_ops (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Create representor netdev (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: RVU representor driver (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-af: Knobs for NPC default rule counters (Linu Cherian)  [Orabug: 39318904]
- octeontx2-af: Refactor few NPC mcam APIs (Linu Cherian)  [Orabug: 39318904]
- octeontx2-pf: Move shared APIs to header file (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Reuse PF max mtu value (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Add new APIs for queue memory alloc/free. (Geetha sowjanya)  [Orabug: 39318904]
- octeontx2-pf: Define common API for HW resources configuration (Geetha sowjanya)  [Orabug: 39318904]
- net: marvell: use ethtool string helpers (Rosen Penev)  [Orabug: 39318904]
- uek: kabi: update kABI files for new symbols (Saeed Mirzamohammadi)  [Orabug: 39268116]
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39167615]  {CVE-2026-31402}
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39110670]  {CVE-2026-23278}
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39103229]  {CVE-2026-23270}</changelog>
  <changelog author="Saeed Mirzamohammadi &lt;saeed.mirzamohammadi@oracle.com&gt; [6.12.0-203.76.5.el10uek]" date="1779192000">- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39407652]  {CVE-2026-46333}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.6.el10uek]" date="1779796800">- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39442660]  {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39442660]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.7.el10uek]" date="1779969600">- tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi)  [Orabug: 39456024]
- tap: free page on error paths in tap_get_user_xdp() (Weiming Shi)  [Orabug: 39456024]
- tun: free page on short-frame rejection in tun_xdp_one() (Weiming Shi)  [Orabug: 39456024]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-203.76.7.1.el10uek]" date="1780315200">- smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39474418]</changelog>
</package>
<package pkgid="6bd50939e188fab8900a727da1938c464f812575" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="100.28.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.2.el10uek]" date="1751198400">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357} 
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38129827]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
</package>
<package pkgid="e471515f2ad937efc6b14ee5a7e2471f63a9f062" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="100.28.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.el10uek]" date="1743681600">- block: prevent calls to should_fail_bio() optimized by gcc (Prasad Singamsetty)  [Orabug: 37782458]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-0.20.20.1.el10uek]" date="1744027200">- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Håkon Bugge)  [Orabug: 37702023]
- scsi: mpi3mr: Task Abort EH Support (Chandrakanth Patil)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.13.0.5.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Check admin reply queue from Watchdog (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update timestamp only for supervisor IOCs (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update MPI Headers to revision 35 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Fix locking in an error path (Bart Van Assche)  [Orabug: 37778472]
- scsi: mpi3mr: Fix spelling mistake "skiping" -&gt; "skipping" (Colin Ian King)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Support for Segmented Hardware Trace buffer (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Avoid reply queue full condition (Ranjan Kumar)  [Orabug: 37778472]
- scsi: mpi3mr: Update driver version to 8.12.0.3.50 (Ranjan Kumar)  [Orabug: 37778472]
- uek-rpm: Enable Intel In Field Scan as a module in UEK8 (Harshit Mogalapalli)  [Orabug: 37778856]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.1.el10uek]" date="1744718400">- LTS version: v6.12.23 (Jack Vogel)
- platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() (Dan Carpenter)
- tracing: Do not use PERF enums when perf is not defined (Steven Rostedt)
- ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE (Nathan Chancellor)
- NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up (Chuck Lever)
- NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory (Chuck Lever)
- NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() (Chuck Lever)
- nfsd: fix management of listener transports (Olga Kornievskaia)
- nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng)
- nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() (Jeff Layton)
- media: streamzap: fix race between device disconnection and urb callback (Murad Masimov)
- media: vimc: skip .s_stream() for stopped entities (Nikita Zhandarovich)
- exec: fix the racy usage of fs_struct-&gt;in_exec (Oleg Nesterov)
- mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (Yosry Ahmed)
- jfs: add index corruption check to DT_GETPAGE() (Roman Smirnov)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- ext4: fix OOB read when checking dotdot dir (Acs, Jakub)
- ext4: don't over-report free space or inodes in statvfs (Theodore Ts'o)
- wifi: mt76: mt7921: fix kernel panic due to null pointer dereference (Ming Yen Hsieh)
- arm64: Don't call NULL in do_compat_alignment_fixup() (Angelos Oikonomopoulos)
- mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs (David Hildenbrand)
- tracing/osnoise: Fix possible recursive locking for cpus_read_lock() (Ran Xiaokai)
- tracing: Fix synth event printk format for str fields (Douglas Raillard)
- tracing: Ensure module defining synth event cannot be unloaded while tracing (Douglas Raillard)
- tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu)
- exfat: fix potential wrong error return from get_block (Sungjong Seo)
- exfat: fix random stack corruption after get_block (Sungjong Seo)
- ksmbd: fix null pointer dereference in alloc_preauth_hash() (Namjae Jeon)
- ksmbd: validate zero num_subauth before sub_auth is accessed (Norbert Szetei)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- ksmbd: fix session use-after-free in multichannel connection (Namjae Jeon)
- ksmbd: fix use-after-free in ksmbd_sessions_deregister() (Namjae Jeon)
- ksmbd: add bounds check for create lease context (Norbert Szetei)
- ksmbd: add bounds check for durable handle context (Namjae Jeon)
- KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
- mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD (Ulf Hansson)
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (Karel Balej)
- mmc: omap: Fix memory leak in mmc_omap_new_slot (Miaoqian Lin)
- Remove unnecessary firmware version check for gc v9_4_2 (Candice Li)
- media: omap3isp: Handle ARM dma_iommu_mapping (Robin Murphy)
- ARM: 9444/1: add KEEP() keyword to ARM_VECTORS (Christian Eggers)
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (Paul Menzel)
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (Murad Masimov)
- wifi: mt76: mt7925: remove unused acpi function for clc (Ming Yen Hsieh)
- x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Jann Horn)
- x86/tsc: Always save/restore TSC sched_clock() on suspend/resume (Guilherme G. Piccoli)
- x86/Kconfig: Add cmpxchg8b support back to Geode CPUs (Arnd Bergmann)
- uprobes/x86: Harden uretprobe syscall trampoline check (Jiri Olsa)
- perf/x86/intel: Avoid disable PMU if !cpuc-&gt;enabled in sample read (Kan Liang)
- perf/x86/intel: Apply static call for drain_pebs (Peter Zijlstra (Intel))
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (Markus Elfring)
- platform/x86: ISST: Correct command storage data length (Srinivas Pandruvada)
- platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560 (Eduard Christian Dumitrescu)
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (Hans de Goede)
- x86/tdx: Fix arch_safe_halt() execution for TDX VMs (Vishal Annapurve)
- x86/mce: use is_copy_from_user() to determine copy-from-user context (Shuai Xue)
- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (Boris Ostrovsky)
- KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
- x86/hyperv: Fix check of return value from snp_set_vmsa() (Tianyu Lan)
- LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC (Hengqi Chen)
- LoongArch: BPF: Don't override subprog's return value (Hengqi Chen)
- LoongArch: BPF: Fix off-by-one error in build_prologue() (Hengqi Chen)
- LoongArch: Increase MAX_IO_PICS up to 8 (Huacai Chen)
- LoongArch: Increase ARCH_DMA_MINALIGN up to 16 (Huacai Chen)
- rust: Fix enabling Rust and building with GCC for LoongArch (WANG Rui)
- usbnet:fix NPE during rx_complete (Ying Lu)
- wifi: mac80211: Fix sparse warning for monitor_sdata (Alexander Wetzel)
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (Sherry Sun)
- tty: serial: fsl_lpuart: Fix unused variable 'sport' build warning (Sherry Sun)
- tty: serial: fsl_lpuart: use port struct directly to simply code (Sherry Sun)
- tty: serial: fsl_lpuart: Use u32 and u8 for register variables (Sherry Sun)
- cgroup/rstat: Fix forceidle time in cpu.stat (Abel Wu)
- cgroup/rstat: Tracking cgroup-level niced CPU time (Joshua Hahn)
- tracing: Correct the refcount if the hist/hist_debug file fails to open (Tengda Wu)
- tracing/hist: Support POLLPRI event for poll on histogram (Masami Hiramatsu (Google))
- tracing/hist: Add poll(POLLIN) support on hist file (Masami Hiramatsu (Google))
- tracing: Switch trace_events_hist.c code over to use guard() (Steven Rostedt)
- tools/power turbostat: report CoreThr per measurement interval (Len Brown)
- perf/core: Fix child_total_time_enabled accounting bug at task exit (Yeoreum Yun)
- drm/amdgpu/gfx12: fix num_mec (Alex Deucher)
- drm/amdgpu/gfx11: fix num_mec (Alex Deucher)
- kbuild: deb-pkg: don't set KBUILD_BUILD_VERSION unconditionally (Alexandru Gagniuc)
- net: ibmveth: make veth_pool_store stop hanging (Dave Marquardt)
- arcnet: Add NULL check in com20020pci_probe() (Henry Martin)
- ipv6: Do not consider link down nexthops in path selection (Ido Schimmel)
- ipv6: Start path selection from the first nexthop (Ido Schimmel)
- net: fix geneve_opt length integer overflow (Lin Ma)
- net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy (David Oberhollenzer)
- ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS (Fernando Fernandez Mancera)
- netfilter: nft_tunnel: fix geneve_opt type confusion addition (Lin Ma)
- net: decrease cached dst counters in dst_release (Antoine Tenart)
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Guillaume Nault)
- vsock: avoid timeout during connect() if the socket is closing (Stefano Garzarella)
- udp: Fix memory accounting leak. (Kuniyuki Iwashima)
- udp: Fix multiple wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima)
- net: mvpp2: Prevent parser TCAM memory corruption (Tobias Waldekranz)
- sctp: add mutual exclusion in proc_sctp_do_udp_port() (Eric Dumazet)
- net_sched: skbprio: Remove overly strict queue assertions (Cong Wang)
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu)
- netfilter: nf_tables: don't unregister hook when table is dormant (Florian Westphal)
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Pablo Neira Ayuso)
- idpf: fix adapter NULL pointer dereference on reboot (Emil Tantilov)
- e1000e: change k1 configuration on MTP and later platforms (Vitaly Lifshits)
- spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent (Florian Fainelli)
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (Takashi Iwai)
- spi: bcm2835: Do not call gpiod_put() on invalid descriptor (Florian Fainelli)
- ASoC: imx-card: Add NULL check in imx_card_probe() (Henry Martin)
- nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Caleb Sander Mateos)
- riscv/purgatory: 4B align purgatory_start (Björn Töpel)
- riscv/kexec_file: Handle R_RISCV_64 in purgatory relocator (Yao Zi)
- riscv: Fix hugetlb retrieval of number of ptes in case of !present pte (Alexandre Ghiti)
- spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() (Josh Poimboeuf)
- ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe() (Christophe JAILLET)
- s390/entry: Fix setting _CIF_MCCK_GUEST with lowcore relocation (Sven Schnelle)
- ublk: make sure ubq-&gt;canceling is set when queue is frozen (Ming Lei)
- x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs (Herton R. Krzesinski)
- RISC-V: errata: Use medany for relocatable builds (Palmer Dabbelt)
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (Takashi Iwai)
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (Richard Fitzgerald)
- ntb: intel: Fix using link status DB's (Nikita Shubin)
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng)
- riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra (Juhan Jin)
- fs/9p: fix NULL pointer dereference on mkdir (Christian Schoenebeck)
- spufs: fix a leak in spufs_create_context() (Al Viro)
- spufs: fix gang directory lifetimes (Al Viro)
- spufs: fix a leak on spufs_new_file() failure (Al Viro)
- netfs: Fix netfs_unbuffered_read() to return ssize_t rather than int (David Howells)
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (Tasos Sahanidis)
- memory: omap-gpmc: drop no compatible check (Roger Quadros)
- can: statistics: use atomic access in hot path (Oliver Hartkopp)
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx (Navon John Lukose)
- selftests: netfilter: skip br_netfilter queue tests if kernel is tainted (Florian Westphal)
- net: devmem: do not WARN conditionally after netdev_rx_queue_restart() (Taehee Yoo)
- drm/amd: Keep display off while going into S4 (Mario Limonciello)
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)
- x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled (Vladis Dronov)
- x86/hyperv: Fix output argument to hypercall that changes page visibility (Michael Kelley)
- locking/semaphore: Use wake_q to wake up processes outside lock critical section (Waiman Long)
- wifi: mac80211: fix SA Query processing in MLO (Johannes Berg)
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (Emmanuel Grumbach)
- ASoC: rt1320: set wake_capable = 0 explicitly (Bard Liao)
- ASoC: codecs: wsa884x: report temps to hwmon in millidegree of Celsius (Alexey Klimov)
- x86/hyperv/vtl: Stop kernel from probing VTL0 low memory (Naman Jain)
- sched/deadline: Use online cpus for validating runtime (Shrikanth Hegde)
- ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA (Stefan Binding)
- exfat: add a check for invalid data size (Yuezhang Mo)
- platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA (Shyam Sundar S K)
- platform/x86/amd/pmf: Propagate PMF-TA return codes (Shyam Sundar S K)
- HID: i2c-hid: improve i2c_hid_get_report error message (Wentao Guan)
- net: dsa: rtl8366rb: don't prompt users for LED control (Jakub Kicinski)
- platform/x86/intel/vsec: Add Diamond Rapids support (David E. Box)
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (Dmitry Panchenko)
- cifs: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- smb: common: change the data type of num_aces to le16 (Namjae Jeon)
- perf/core: Fix perf_pmu_register() vs. perf_init_event() (Peter Zijlstra)
- ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0 (Daniel Bárta)
- ALSA: hda/realtek: Fix Asus Z13 2025 audio (Antheas Kapenekakis)
- affs: don't write overlarge OFS data block size fields (Simon Tatham)
- affs: generate OFS sequence numbers starting at 1 (Simon Tatham)
- wifi: brcmfmac: keep power during suspend if board requires it (Matthias Proske)
- nvme-pci: skip CMB blocks incompatible with PCI P2P DMA (Icenowy Zheng)
- nvme-pci: clean up CMBMSC when registering CMB fails (Icenowy Zheng)
- nvme-tcp: fix possible UAF in nvme_tcp_poll (Sagi Grimberg)
- wifi: iwlwifi: mvm: use the right version of the rate API (Emmanuel Grumbach)
- wifi: iwlwifi: fw: allocate chained SG tables for dump (Johannes Berg)
- wifi: mac80211: remove debugfs dir for virtual monitor (Alexander Wetzel)
- wifi: mac80211: Cleanup sta TXQs on flush (Alexander Wetzel)
- nfs: Add missing release on error in nfs_lock_and_join_requests() (Dan Carpenter)
- objtool/loongarch: Add unwind hints in prepare_frametrace() (Josh Poimboeuf)
- rcu-tasks: Always inline rcu_irq_work_resched() (Josh Poimboeuf)
- context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() (Josh Poimboeuf)
- sched/smt: Always inline sched_smt_active() (Josh Poimboeuf)
- objtool: Fix verbose disassembly if CROSS_COMPILE isn't set (David Laight)
- octeontx2-af: Free NIX_AF_INT_VEC_GEN irq (Geetha sowjanya)
- octeontx2-af: Fix mbox INTR handler when num VFs &gt; 64 (Geetha sowjanya)
- net: phy: broadcom: Correct BCM5221 PHY model detection (Jim Liu)
- ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Giovanni Gherdovich)
- LoongArch: Rework the arch_kgdb_breakpoint() implementation (Yuli Wang)
- LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() (Miaoqian Lin)
- LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig (谢致邦 (XIE Zhibang))
- objtool: Fix segfault in ignore_unreachable_insn() (Josh Poimboeuf)
- ring-buffer: Fix bytes_dropped calculation issue (Feng Yang)
- net/mlx5e: SHAMPO, Make reserved size independent of page size (Lama Kayal)
- ksmbd: fix r_count dec/increment mismatch (Namjae Jeon)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- ksmbd: use aead_request_free to match aead_request_alloc (Miaoqian Lin)
- rndis_host: Flag RNDIS modems as WWAN devices (Lubomir Rintel)
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Mark Zhang)
- exfat: fix missing shutdown check (Yuezhang Mo)
- exfat: fix the infinite loop in exfat_find_last_cluster() (Yuezhang Mo)
- smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Wang Zhaolong)
- NFS: Shut down the nfs_client only after all the superblocks (Trond Myklebust)
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf)
- objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() (Josh Poimboeuf)
- thermal: core: Remove duplicate struct declaration (xueqin Luo)
- perf bpf-filter: Fix a parsing error with comma (Namhyung Kim)
- perf tools: annotate asm_pure_loop.S (Marcus Meissner)
- fs/procfs: fix the comment above proc_pid_wchan() (Bart Van Assche)
- perf vendor events arm64 AmpereOneX: Fix frontend_bound calculation (Ilkka Koskinen)
- tty: n_tty: use uint for space returned by tty_write_room() (Jiri Slaby (SUSE))
- staging: vchiq_arm: Fix possible NPR of keep-alive thread (Stefan Wahren)
- staging: vchiq_arm: Register debugfs after cdev (Stefan Wahren)
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (谢致邦 (XIE Zhibang))
- perf: intel-tpebs: Fix incorrect usage of zfree() (James Clark)
- perf python: Check if there is space to copy all the event (Arnaldo Carvalho de Melo)
- perf python: Don't keep a raw_data pointer to consumed ring buffer space (Arnaldo Carvalho de Melo)
- perf python: Decrement the refcount of just created event on failure (Arnaldo Carvalho de Melo)
- perf python: Fixup description of sample.id event member (Arnaldo Carvalho de Melo)
- i3c: master: svc: Fix missing the IBI rules (Stanley Chu)
- um: hostfs: avoid issues on inode number reuse by host (Benjamin Berg)
- um: remove copy_from_kernel_nofault_allowed (Benjamin Berg)
- um: Pass the correct Rust target and options with gcc (David Gow)
- selftests/mm/cow: fix the incorrect error handling (Cyan Yang)
- fuse: fix dax truncate/punch_hole fault path (Alistair Popple)
- NFS: fix open_owner_id_maxsz and related fields. (NeilBrown)
- NFSv4: Avoid unnecessary scans of filesystems for delayed delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for expired delegations (Trond Myklebust)
- NFSv4: Avoid unnecessary scans of filesystems for returning delegations (Trond Myklebust)
- NFSv4: Don't trigger uneccessary scans for return-on-close delegations (Trond Myklebust)
- arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig (Anshuman Khandual)
- ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev)
- kexec: initialize ELF lowest address to ULONG_MAX (Sourabh Jain)
- kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() (David Hildenbrand)
- perf units: Fix insufficient array space (Arnaldo Carvalho de Melo)
- perf evlist: Add success path to evlist__create_syswide_maps (Ian Rogers)
- perf debug: Avoid stack overflow in recursive error message (Ian Rogers)
- iio: light: Add check for array bounds in veml6075_read_int_time_ms (Karan Sanghavi)
- iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset (Jonathan Santos)
- iio: adc: ad7173: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad7124: Fix comparison of channel configs (Uwe Kleine-König)
- iio: adc: ad4130: Fix comparison of channel setups (Uwe Kleine-König)
- dmaengine: fsl-edma: free irq correctly in remove path (Peng Fan)
- dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister (Peng Fan)
- fs/ntfs3: Prevent integer overflow in hdr_first_de() (Dan Carpenter)
- fs/ntfs3: Fix a couple integer overflows on 32bit systems (Dan Carpenter)
- usb: xhci: correct debug message page size calculation (Niklas Neronin)
- perf bench: Fix perf bench syscall loop count (Thomas Richter)
- perf arm-spe: Fix load-store operation checking (Leo Yan)
- iio: backend: make sure to NULL terminate stack buffer (Nuno Sá)
- iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails. (Jonathan Cameron)
- iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio (Jonathan Cameron)
- ucsi_ccg: Don't show failed to get FW build information error (Mario Limonciello)
- perf build: Fix in-tree build due to symbolic link (Luca Ceresoli)
- tools/x86: Fix linux/unaligned.h include path in lib/insn.c (Ian Rogers)
- perf pmu: Don't double count common sysfs and json events (James Clark)
- coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie)
- coresight: catu: Fix number of pages while using 64k pages (Ilkka Koskinen)
- greybus: gb-beagleplay: Add error handling for gb_greybus_init (Wentao Liang)
- perf report: Switch data file correctly in TUI (Namhyung Kim)
- soundwire: slave: fix an OF node reference leak in soundwire slave device (Joe Hattori)
- isofs: fix KMSAN uninit-value bug in do_isofs_readdir() (Qasim Ijaz)
- phy: phy-rockchip-samsung-hdptx: Don't use dt aliases to determine phy-id (Heiko Stuebner)
- fs/ntfs3: Update inode-&gt;i_mapping-&gt;a_ops on compression state (Konstantin Komarov)
- w1: fix NULL pointer dereference in probe (Chenyuan Yang)
- perf: Always feature test reallocarray (James Clark)
- perf stat: Fix find_stat for mixed legacy/non-legacy events (Ian Rogers)
- clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock (Barnabás Czémán)
- pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (Andy Shevchenko)
- crypto: hisilicon/sec2 - fix for aead auth key length (Wenkai Lin)
- RDMA/core: Fix use-after-free when rename device name (Wang Liang)
- x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment (Jann Horn)
- leds: Fix LED_OFF brightness race (Remi Pommarel)
- mfd: sm501: Switch to BIT() to mitigate integer overflows (Nikita Zhandarovich)
- pinctrl: renesas: rzv2m: Fix missing of_node_put() call (Fabrizio Castro)
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad)
- bpf: Fix array bounds error with may_goto (Jiayuan Chen)
- clk: qcom: gcc-sm8650: Do not turn off USB GDSCs during gdsc_disable() (Neil Armstrong)
- crypto: nx - Fix uninitialised hv_nxc on error (Herbert Xu)
- power: supply: max77693: Fix wrong conversion of charge input threshold value (Artur Weber)
- x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 (Jann Horn)
- clk: amlogic: g12a: fix mmc A peripheral clock (Jerome Brunet)
- clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents (Laurentiu Mihalcea)
- crypto: qat - remove access to parity register for QAT GEN4 (Bairavi Alagappan)
- pinctrl: npcm8xx: Fix incorrect struct npcm8xx_pincfg assignment (Andy Shevchenko)
- rust: fix signature of rust_fmt_argument (Alice Ryhl)
- selftests/bpf: Select NUMA_NO_NODE to create map (Saket Kumar Bhaskar)
- clk: amlogic: gxbb: drop non existing 32k clock parent (Jerome Brunet)
- clk: amlogic: g12b: fix cluster A parent data (Jerome Brunet)
- pinctrl: tegra: Set SFIO mode to Mux Register (Prathamesh Shete)
- IB/mad: Check available slots before posting receive WRs (Maher Sanalla)
- crypto: api - Fix larval relookup type and mask (Herbert Xu)
- power: supply: bq27xxx_battery: do not update cached flags prematurely (Sicelo A. Mhlongo)
- remoteproc: qcom_q6v5_mss: Handle platforms with one power domain (Luca Weiss)
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() (Cheng Xu)
- RDMA/mlx5: Fix calculation of total invalidated pages (Chiara Meiohas)
- RDMA/core: Don't expose hw_counters outside of init net namespace (Roman Gushchin)
- clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent (Peter Geis)
- selftests/bpf: Fix freplace_link segfault in tailcalls prog test (Tengda Wu)
- RDMA/mlx5: Fix MR cache initialization error flow (Michael Guralnik)
- pinctrl: renesas: rzg2l: Fix missing of_node_put() call (Fabrizio Castro)
- pinctrl: renesas: rza2: Fix missing of_node_put() call (Fabrizio Castro)
- lib: 842: Improve error handling in sw842_compress() (Tanya Agarwal)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- clk: qcom: gcc-x1e80100: Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK (Konrad Dybcio)
- remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226 (Luca Weiss)
- crypto: tegra - Set IV to NULL explicitly for AES ECB (Akhil R)
- RDMA/mana_ib: Ensure variable err is initialized (Kees Bakker)
- s390: Remove ioremap_wt() and pgprot_writethrough() (Niklas Schnelle)
- clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock (Vladimir Lypak)
- crypto: tegra - Fix CMAC intermediate result handling (Akhil R)
- pinctrl: nuvoton: npcm8xx: Fix error handling in npcm8xx_gpio_fw() (Yue Haibing)
- clk: samsung: Fix UBSAN panic in samsung_clk_init() (Will McVicker)
- remoteproc: qcom: pas: add minidump_id to SC7280 WPSS (Luca Weiss)
- clk: renesas: r8a08g045: Check the source of the CPU PLL settings (Claudiu Beznea)
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() (David Hildenbrand)
- selftests/bpf: Fix string read in strncmp benchmark (Viktor Malik)
- libbpf: Fix hypothetical STT_SECTION extern NULL deref case (Andrii Nakryiko)
- remoteproc: qcom_q6v5_pas: Make single-PD handling more robust (Luca Weiss)
- pinctrl: renesas: rzg2l: Suppress binding attributes (Claudiu Beznea)
- of: property: Increase NR_FWNODE_REFERENCE_ARGS (Zijun Hu)
- remoteproc: core: Clear table_sz when rproc_shutdown (Peng Fan)
- RDMA/mlx5: Fix page_size variable overflow (Michael Guralnik)
- crypto: hisilicon/sec2 - fix for sec spec check (Wenkai Lin)
- crypto: hisilicon/sec2 - fix for aead authsize alignment (Wenkai Lin)
- clk: amlogic: gxbb: drop incorrect flag on 32k clock (Jerome Brunet)
- crypto: tegra - Use HMAC fallback when keyslots are full (Akhil R)
- crypto: bpf - Add MODULE_DESCRIPTION for skcipher (Arnd Bergmann)
- crypto: tegra - check return value for hash do_one_req (Akhil R)
- crypto: tegra - Use separate buffer for setkey (Akhil R)
- crypto: qat - set parity error mask for qat_420xx (Bairavi Alagappan)
- crypto: iaa - Test the correct request flag (Herbert Xu)
- fbdev: sm501fb: Add some geometry checks. (Danila Chernetsov)
- mdacon: rework dependency list (Arnd Bergmann)
- dummycon: fix default rows/cols (Arnd Bergmann)
- fbdev: au1100fb: Move a variable assignment behind a null pointer check (Markus Elfring)
- PCI: pciehp: Don't enable HPIE when resuming in poll mode (Ilpo Järvinen)
- PCI: Fix BAR resizing when VF BARs are assigned (Ilpo Järvinen)
- PCI: histb: Fix an error handling path in histb_pcie_probe() (Christophe JAILLET)
- PCI: dwc: ep: Return -ENOMEM for allocation failures (Dan Carpenter)
- drm/amd/display: avoid NPD when ASIC does not support DMUB (Thadeu Lima de Souza Cascardo)
- drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer() (Dan Carpenter)
- drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr (Douglas Anderson)
- drm/mediatek: Fix config_updating flag never false when no mbox channel (Jason-JH Lin)
- PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe (Thippeswamy Havalige)
- PCI: Remove stray put_device() in pci_register_host_bridge() (Dan Carpenter)
- powerpc/kexec: fix physical address calculation in clear_utlb_entry() (Christophe Leroy)
- crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD (Christophe Leroy)
- drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump (Rob Clark)
- drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters() (Vitaliy Shevtsov)
- drm/panthor: Update CS_STATUS_ defines to correct values (Ashley Smith)
- PCI: Avoid reset when disabled via sysfs (Nishanth Aravamudan)
- PCI/portdrv: Only disable pciehp interrupts early when needed (Feng Tang)
- PCI: brcmstb: Fix potential premature regulator disabling (Jim Quinlan)
- PCI: brcmstb: Fix error path after a call to regulator_bulk_get() (Jim Quinlan)
- PCI: brcmstb: Use internal register to change link capability (Jim Quinlan)
- PCI: brcmstb: Set generation limit before PCIe link up (Jim Quinlan)
- PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload (Hans Zhang)
- drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables' (Srinivasan Shanmugam)
- drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host (Marijn Suijten)
- drm/msm/dsi: Use existing per-interface slice count in DSC timing (Marijn Suijten)
- drm/msm/dsi/phy: Program clock inverters in correct register (Krzysztof Kozlowski)
- drm/msm/dpu: don't use active in atomic_check() (Dmitry Baryshkov)
- drm/amd/display: fix an indent issue in DML21 (Aurabindo Pillai)
- PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave)
- drm/panel: ilitek-ili9882t: fix GPIO name in error message (John Keeping)
- PCI/ASPM: Fix link state exit during switch upstream function removal (Daniel Stodden)
- drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_hdmi: Unregister audio platform device on failure (AngeloGioacchino Del Regno)
- PCI: Remove add_align overwrite unrelated to size0 (Ilpo Järvinen)
- PCI: Use downstream bridges for distributing resources (Kai-Heng Feng)
- drm/amdgpu/umsch: fix ucode check (Alex Deucher)
- drm/amdgpu: refine smu send msg debug log format (Yang Wang)
- gpu: cdns-mhdp8546: fix call balance of mhdp-&gt;clk handling routines (Vitalii Mordan)
- drm/vkms: Fix use after free and double free on init error (José Expósito)
- drm: xlnx: zynqmp: Fix max dma segment size (Tomi Valkeinen)
- drm/bridge: it6505: fix HDCP V match check is not performed correctly (Hermes Wu)
- drm/dp_mst: Fix drm RAD print (Wayne Lin)
- drm/ssd130x: ensure ssd132x pitch is correct (John Keeping)
- drm/ssd130x: fix ssd132x encoding (John Keeping)
- drm/ssd130x: Set SPI .id_table to prevent an SPI core warning (Javier Martinez Canillas)
- drm/bridge: ti-sn65dsi86: Fix multiple instances (Geert Uytterhoeven)
- ALSA: timer: Don't take register_mutex with copy_from/to_user() (Takashi Iwai)
- ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible (Jayesh Choudhary)
- ALSA: hda/realtek: Always honor no_shutup_pins (Takashi Iwai)
- dt-bindings: vendor-prefixes: add GOcontroll (Maud Spierings)
- HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER (Jiri Kosina)
- ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry (Venkata Prasad Potturu)
- ASoC: cs35l41: check the return value from spi_setup() (Vitaliy Shevtsov)
- platform/x86: dell-ddv: Fix temperature calculation (Armin Wolf)
- platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static (Ilpo Järvinen)
- platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static (Ilpo Järvinen)
- auxdisplay: panel: Fix an API misuse in panel.c (Andy Shevchenko)
- media: platform: allgro-dvt: unregister v4l2_device on the error path (Joe Hattori)
- media: verisilicon: HEVC: Initialize start_bit field (Benjamin Gaignard)
- auxdisplay: MAX6959 should select BITREVERSE (Geert Uytterhoeven)
- regulator: pca9450: Fix enable register for LDO5 (Frieder Schrempf)
- x86/entry: Add __init to ia32_emulation_override_cmdline() (Vitaly Kuznetsov)
- x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures (Chao Gao)
- x86/traps: Make exc_double_fault() consistently noreturn (Josh Poimboeuf)
- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (Tao Chen)
- lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() (Sebastian Andrzej Siewior)
- PM: sleep: Fix handling devices with direct_complete set on errors (Rafael J. Wysocki)
- thermal: int340x: Add NULL check for adev (Chenyuan Yang)
- x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors (James Morse)
- EDAC/ie31200: Fix the error path order of ie31200_init() (Qiuxu Zhuo)
- EDAC/ie31200: Fix the DIMM size mask for several SoCs (Qiuxu Zhuo)
- EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer (Qiuxu Zhuo)
- selinux: Chain up tool resolving errors in install_policy.sh (Tim Schumacher)
- watchdog/hardlockup/perf: Fix perf_event memory leak (Li Huafei)
- kunit/stackinit: Use fill byte different from Clang i386 pattern (Kees Cook)
- RISC-V: KVM: Disable the kernel perf counter during configure (Atish Patra)
- cpufreq: tegra194: Allow building for Tegra234 (Aaron Kling)
- PM: sleep: Adjust check before setting power.must_resume (Rafael J. Wysocki)
- lockdep/mm: Fix might_fault() lockdep check of current-&gt;mm-&gt;mmap_lock (Peter Zijlstra)
- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (Kevin Loughlin)
- x86/platform: Only allow CONFIG_EISA for 32-bit (Arnd Bergmann)
- x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() (Benjamin Berg)
- x86/fpu: Fix guest FPU state buffer allocation size (Stanislav Spassov)
- EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids (Qiuxu Zhuo)
- cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() (Jie Zhan)
- sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks (Tianchen Ding)
- sched: Cancel the slice protection of the idle entity (zihan zhou)
- smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label (Konstantin Andreev)
- smack: dont compile ipv6 code unless ipv6 is configured (Konstantin Andreev)
- cpufreq: scpi: compare kHz instead of Hz (zuoqian)
- x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Mike Rapoport (Microsoft))
- watch_queue: fix pipe accounting mismatch (Eric Sandeen)
- LTS version: v6.12.22 (Jack Vogel)
- bcachefs: bch2_ioctl_subvolume_destroy() fixes (Kent Overstreet)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- serial: stm32: do not deassert RS485 RTS GPIO prematurely (Cheick Traore)
- perf tools: Fix up some comments and code to properly use the event_source bus (Greg Kroah-Hartman)
- memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Luo Qiu)
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio)
- usb: xhci: Don't skip on Stopped - Length Invalid (Michal Pecio)
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (Fabio Porcedda)
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (Fabio Porcedda)
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (Sherry Sun)
- tty: serial: 8250: Add Brainboxes XC devices (Cameron Williams)
- tty: serial: 8250: Add some more device IDs (Cameron Williams)
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (William Breathitt Gray)
- counter: stm32-lptimer-cnt: fix error handling when enabling (Fabrice Gasnier)
- ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx (Dhruv Deshpande)
- netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy)
- drm/amd/display: Don't write DP_MSTM_CTRL after LT (Wayne Lin)
- atm: Fix NULL pointer dereference (Minjoong Kim)
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (Terry Junge)
- ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names (Terry Junge)
- LTS version: v6.12.21 (Jack Vogel)
- mptcp: Fix data stream corruption in the address announcement (Arthur Mongodin)
- mm/huge_memory: drop beyond-EOF folios with the right number of refs (Zi Yan)
- arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S (Justin Klaassen)
- libsubcmd: Silence compiler warning (Eder Zulian)
- Revert "sched/core: Reduce cost of sched_move_task when config autogroup" (Dietmar Eggemann)
- KVM: arm64: Eagerly switch ZCR_EL{1,2} (Mark Rutland)
- KVM: arm64: Mark some header functions as inline (Mark Rutland)
- KVM: arm64: Refactor exit handlers (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN (Mark Rutland)
- KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN (Mark Rutland)
- KVM: arm64: Remove host FPSIMD saving for non-protected KVM (Mark Rutland)
- KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state (Mark Rutland)
- KVM: arm64: Calculate cptr_el2 traps on activating traps (Fuad Tabba)
- io_uring/net: fix sendzc double notif flush (Pavel Begunkov)
- ksmbd: fix incorrect validation for num_aces field of smb_acl (Namjae Jeon)
- drm/amdkfd: Fix user queue validation on Gfx7/8 (Philip Yang)
- drm/amdgpu: Fix JPEG video caps max size for navi1x and raven (David Rosca)
- drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size (David Rosca)
- drm/amdgpu: Remove JPEG from vega and carrizo video caps (David Rosca)
- drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2 (Alex Deucher)
- drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2 (Tomasz Pakuła)
- drm/amdgpu: Restore uncached behaviour on GFX12 (David Belanger)
- drm/amd/pm: add unique_id for gfx12 (Harish Kasiviswanathan)
- drm/amd/display: Use HW lock mgr for PSR1 when only one eDP (Mario Limonciello)
- drm/amd/display: Fix message for support_edp0_on_dp1 (Yilin Chen)
- drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini() (Wentao Liang)
- drm/sched: Fix fence reference count leak (qianyi liu)
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich)
- pmdomain: amlogic: fix T7 ISP secpower (Xianwei Zhao)
- soc: qcom: pdr: Fix the potential deadlock (Saranya R)
- batman-adv: Ignore own maximum aggregation size during RX (Sven Eckelmann)
- xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia)
- keys: Fix UAF in key_put() (David Howells)
- efi/libstub: Avoid physical address 0x0 when doing random allocation (Ard Biesheuvel)
- firmware: qcom: uefisecapp: fix efivars registration race (Johan Hovold)
- ARM: shmobile: smp: Enforce shmobile_smp_* alignment (Geert Uytterhoeven)
- ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 (Stefan Eichenberger)
- memcg: drain obj stock on cpu hotplug teardown (Shakeel Butt)
- proc: fix UAF in proc_get_inode() (Ye Bin)
- mm/page_alloc: fix memory accept before watermarks gets initialized (Kirill A. Shutemov)
- mm/migrate: fix shmem xarray update during migration (Zi Yan)
- mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT (Raphael S. Carvalho)
- selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation (Rafael Aquini)
- mmc: atmel-mci: Add missing clk_disable_unprepare() (Gu Bowen)
- mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops (Kamal Dasu)
- arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou (Quentin Schulz)
- arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card (Stefan Eichenberger)
- accel/qaic: Fix integer overflow in qaic_validate_req() (Dan Carpenter)
- regulator: check that dummy regulator has been probed before using it (Christian Eggers)
- regulator: dummy: force synchronous probing (Christian Eggers)
- netfs: Call `invalidate_cache` only if implemented (Max Kellermann)
- riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions (E Shattow)
- io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally (Jens Axboe)
- drm/v3d: Don't run jobs that have errors flagged in its fence (Maíra Canal)
- drm/xe: Fix exporting xe buffers multiple times (Tomasz Rusinowicz)
- can: flexcan: disable transceiver during system PM (Haibo Chen)
- can: flexcan: only change CAN state when link up in system PM (Haibo Chen)
- can: ucan: fix out of bound read in strscpy() source (Vincent Mailhol)
- can: rcar_canfd: Fix page entries in the AFL list (Biju Das)
- dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M (Biju Das)
- net: mana: Support holes in device list reply msg (Haiyang Zhang)
- i2c: omap: fix IRQ storms (Andreas Kemnade)
- tracing: tprobe-events: Fix leakage of module refcount (Masami Hiramatsu (Google))
- Revert "gre: Fix IPv6 link-local address generation." (Guillaume Nault)
- net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES (Lin Ma)
- libfs: Fix duplicate directory entry in offset_dir_lookup (Yongjian Sun)
- net: ipv6: ioam6: fix lwtunnel_output() loop (Justin Iurman)
- net: lwtunnel: fix recursion loops (Justin Iurman)
- net: ti: icssg-prueth: Add lock to stats (MD Danish Anwar)
- net: atm: fix use after free in lec_send() (Dan Carpenter)
- gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU (Jason Gunthorpe)
- phy: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- dpll: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski)
- ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). (Kuniyuki Iwashima)
- ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). (Kuniyuki Iwashima)
- net: ipv6: fix TCP GSO segmentation with NAT (Felix Fietkau)
- net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence (Vignesh Raghavendra)
- ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs (Niklas Cassel)
- tracing: tprobe-events: Fix to clean up tprobe correctly when module unload (Masami Hiramatsu (Google))
- ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX (David Lechner)
- accel/qaic: Fix possible data corruption in BOs &gt; 2G (Jeffrey Hugo)
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters (Arkadiusz Bokowy)
- Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter)
- RDMA/hns: Fix wrong value of max_sge_rd (Junxian Huang)
- RDMA/hns: Fix missing xa_destroy() (Junxian Huang)
- RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() (Junxian Huang)
- RDMA/hns: Fix invalid sq params not being blocked (Junxian Huang)
- RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() (Junxian Huang)
- RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang)
- RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path (Saravanan Vajravel)
- dma-mapping: fix missing clear bdr in check_ram_in_range_map() (Baochen Qiang)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200 (Chester A. Unal)
- ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300 (Chester A. Unal)
- ARM: dts: bcm2711: Don't mark timer regs unconfigured (Phil Elwell)
- ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP (Arnd Bergmann)
- RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() (Qasim Ijaz)
- RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx (Kashyap Desai)
- RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests (Zhu Yanjun)
- arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1 (Yao Zi)
- arm64: dts: bcm2712: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: PL011 UARTs are actually r1p5 (Phil Elwell)
- ARM: dts: bcm2711: Fix xHCI power-domain (Stefan Wahren)
- soc: imx8m: Unregister cpufreq and soc dev in cleanup path (Peng Fan)
- soc: imx8m: Use devm_* to simplify probe failure handling (Marek Vasut)
- soc: imx8m: Remove global soc_uid (Marek Vasut)
- xfrm_output: Force software GSO only in tunnel mode (Cosmin Ratiu)
- xfrm: fix tunnel mode TX datapath in packet offload mode (Alexandre Cassen)
- arm64: dts: rockchip: remove supports-cqe from rk3588 tiger (Heiko Stuebner)
- arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar (Heiko Stuebner)
- arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply (Alexander Stein)
- firmware: imx-scu: fix OF node leak in .probe() (Joe Hattori)
- firmware: qcom: scm: Fix error code in probe() (Dan Carpenter)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Håkon Bugge)  [Orabug: 37379052]
- uek-rpm: Set uek_release variable in UEK 8 spec file (Harshit Mogalapalli)  [Orabug: 37801392]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.2.el10uek]" date="1745323200">- vhost_scsi: log write descriptors (Dongli Zhang)  [Orabug: 37393517]
- vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37393517]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju)  [Orabug: 37260584] [Orabug: 37551308]
- Revert "x86/simplefb: simplefb was broken on UEFI mode Oracle and HP system, skip VIDEO_TYPE_EFI" (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm: Replace legacy FBDEV drivers with simpledrm and fbdev emulation layer (Harshit Mogalapalli)  [Orabug: 37638881]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar)
- uek-rpm: Enable gcov build (Sherry Yang)  [Orabug: 37734677]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda)  [Orabug: 37820202]
- drm/mgag200: Added support for the new device G200eH5 (Gwenael Georgeault)  [Orabug: 37835185]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-1.23.3.el10uek]" date="1745409600">- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan)  [Orabug: 37800558]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.24.1.el10uek]" date="1745928000">- x86/microcode/AMD: Clean the cache if update did not load microcode (Boris Ostrovsky)  [Orabug: 37800727]
- LTS version: v6.12.24 (Jack Vogel)
- HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang)
- s390/cpumf: Fix double free on error in cpumf_pmu_event_init() (Thomas Richter)
- Bluetooth: hci_uart: Fix another race during initialization (Arseniy Krasnov)
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline (Arnd Bergmann)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- libbpf: Prevent compiler warnings/errors (Eder Zulian)
- x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() (Myrrh Periwinkle)
- nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton)
- NFSD: Fix CB_GETATTR status fix (Chuck Lever)
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Olga Kornievskaia)
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
- iommufd: Fail replace if device has not been attached (Yi Liu)
- iommufd: Make attach_handle generic than fault specific (Nicolin Chen)
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Douglas Anderson)
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold (Nícolas F. R. A. Prado)
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend (Nícolas F. R. A. Prado)
- selftests: mptcp: fix incorrect fd checks in main_loop (Cong Liu)
- selftests: mptcp: close fd_in before returning in main_loop (Geliang Tang)
- sched_ext: create_dsq: Return -EEXIST on duplicate request (Jake Hillion)
- s390: Fix linker error when -no-pie option is unavailable (Sumanth Korikkar)
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Niklas Schnelle)
- ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() (Steven Rostedt)
- pinctrl: samsung: add support for eint_fltcon_offset (Peter Griffin)
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type (Stephan Gerhold)
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off (Stefan Eichenberger)
- PCI: Fix wrong length of devres array (Philipp Stanner)
- PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke)
- PCI: Fix reference leak in pci_alloc_child_bus() (Ma Ke)
- PCI: pciehp: Avoid unnecessary device replacement check (Lukas Wunner)
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4 (Siddharth Vadapalli)
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe() (Stanimir Varbanov)
- of/irq: Fix device node refcount leakages in of_irq_init() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() (Zijun Hu)
- of/irq: Fix device node refcount leakages in of_irq_count() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw() (Zijun Hu)
- of/irq: Fix device node refcount leakage in API of_irq_parse_one() (Zijun Hu)
- ntb: use 64-bit arithmetic for the MSI doorbell mask (Fedor Pchelkin)
- net: mana: Switch to page pool for jumbo frames (Haiyang Zhang)
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error (Kunihiko Hayashi)
- selftests/landlock: Add a new test for setuid() (Mickaël Salaün)
- selftests/landlock: Split signal_scoping_threads tests (Mickaël Salaün)
- landlock: Prepare to add second errata (Mickaël Salaün)
- landlock: Always allow signals between threads of the same process (Mickaël Salaün)
- landlock: Add erratum for TCP fix (Mickaël Salaün)
- landlock: Add the errata interface (Mickaël Salaün)
- landlock: Move code to ease future backports (Mickaël Salaün)
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson)
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions (Sean Christopherson)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests (Amit Machhiwal)
- gve: handle overflow when reporting TX consumed descriptors (Joshua Washington)
- gpio: zynq: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- gpio: tegra186: fix resource handling in ACPI probe path (Guixin Liu)
- ftrace: Properly merge notrace hashes (Andy Chiu)
- ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin)
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg' (Krzysztof Kozlowski)
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg' (Krzysztof Kozlowski)
- dm-verity: fix prefetch-vs-suspend race (Mikulas Patocka)
- dm-integrity: fix non-constant-time tag verification (Jo Van Bulck)
- dm-integrity: set ti-&gt;error on memory allocation failure (Mikulas Patocka)
- dm-ebs: fix prefetch-vs-suspend race (Mikulas Patocka)
- dlm: fix error if active rsb is not hashed (Alexander Aring)
- dlm: fix error if inactive rsb is not hashed (Alexander Aring)
- crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
- crypto: ccp - Fix check for the primary ASP device (Tom Lendacky)
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks (Ajit Pandey)
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five (Lad Prabhakar)
- cifs: Ensure that all non-client-specific reparse points are processed by the server (Pali Rohár)
- cifs: fix integer overflow in match_server() (Roman Smirnov)
- cifs: avoid NULL pointer dereference in dbg call (Alexandra Diupina)
- CIFS: Propagate min offload along with other parameters from primary to secondary channels. (Aman)
- thermal/drivers/rockchip: Add missing rk3328 mapping entry (Trevor Woerner)
- tracing: Do not add length to print format in synthetic events (Steven Rostedt)
- tracing: fprobe events: Fix possible UAF on modules (Masami Hiramatsu (Google))
- x86/xen: fix balloon target initialization for PVH dom0 (Roger Pau Monne)
- sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro)
- mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper (Jinjiang Tu)
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section (Marc Herbert)
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages (Shuai Xue)
- mm/userfaultfd: fix release hang over concurrent GUP (Peter Xu)
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock (Mathieu Desnoyers)
- mm/mremap: correctly handle partial mremap() of VMA starting at 0 (Lorenzo Stoakes)
- mm: fix lazy mmu docs and usage (Ryan Roberts)
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu)
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
- mm/damon/ops: have damon_get_folio return folio even for tail pages (Usama Arif)
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes (Ryan Roberts)
- sparc/mm: disable preemption in lazy mmu mode (Ryan Roberts)
- iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs (Sean Christopherson)
- iommu/vt-d: Fix possible circular locking dependency (Lu Baolu)
- iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes (Sean Christopherson)
- iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled (Sean Christopherson)
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() (Nicolin Chen)
- iommufd: Fix uninitialized rc in iommufd_access_rw() (Nicolin Chen)
- btrfs: zoned: fix zone finishing with missing devices (Johannes Thumshirn)
- btrfs: zoned: fix zone activation with missing devices (Johannes Thumshirn)
- btrfs: tests: fix chunk map leak after failure to add it to the tree (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers (Filipe Manana)
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() (Herve Codina)
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node (Peter Griffin)
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string (Chen-Yu Tsai)
- arm64: mm: Correct the update of max_pfn (Zhenhua Huang)
- arm64: tegra: Remove the Orin NX/Nano suspend key (Ninad Malwade)
- arm64: mops: Do not dereference src reg for a set operation (Keir Fraser)
- mtd: rawnand: Add status chack in r852_ready() (Wentao Liang)
- mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang)
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures (Matthieu Baerts (NGI0))
- mptcp: fix NULL pointer in can_accept_new_subflow (Gang Yan)
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (T Pratham)
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class() (Boqun Feng)
- mailbox: tegra-hsp: Define dimensioning masks in SoC data (Kartik Rajput)
- mfd: ene-kb3930: Fix a potential NULL pointer dereference (Chenyuan Yang)
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs (Abel Vesa)
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs (Abel Vesa)
- jbd2: remove wrong sb-&gt;s_sequence check (Jan Kara)
- i3c: Add NULL pointer check in i3c_master_queue_ibi() (Manjunatha Venkatesh)
- i3c: master: svc: Use readsb helper for reading MDB (Stanley Chu)
- ima: limit the number of ToMToU integrity violations (Mimi Zohar)
- ima: limit the number of open-writers integrity violations (Mimi Zohar)
- smb311 client: fix missing tcon check when mounting with linux/posix extensions (Steve French)
- soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() (Chenyuan Yang)
- svcrdma: do not unregister device for listeners (Olga Kornievskaia)
- tpm: do not start chip while suspended (Thadeu Lima de Souza Cascardo)
- udf: Fix inode_getblk() return value (Jan Kara)
- vdpa/mlx5: Fix oversized null mkey longer than 32bit (Si-Wei Liu)
- f2fs: fix to avoid atomicity corruption of atomic file (Yeongjin Gil)
- ext4: fix off-by-one error in do_split (Artem Sadovnikov)
- bus: mhi: host: Fix race between unprepare and queue_buf (Jeff Hugo)
- accel/ivpu: Fix deadlock in ivpu_ms_cleanup() (Jacek Lawrynowicz)
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal() (Jacek Lawrynowicz)
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx (Sharan Kumar M)
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (Alexey Klimov)
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns. (Srinivas Kandagatla)
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer (Srinivas Kandagatla)
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs (Srinivas Kandagatla)
- ASoC: q6apm: add q6apm_get_hw_pointer helper (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() (Haoxiang Li)
- io_uring/kbuf: reject zero sized provided buffers (Jens Axboe)
- io_uring/net: fix io_req_post_cqe abuse by send bundle (Pavel Begunkov)
- io_uring/net: fix accept multishot handling (Pavel Begunkov)
- wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present (Ming Yen Hsieh)
- wifi: mt76: mt7925: fix country count limitation for CLC (Ming Yen Hsieh)
- wifi: mt76: mt7925: ensure wow pattern command align fw format (Ming Yen Hsieh)
- wifi: mac80211: fix integer overflow in hwmp_route_info_get() (Gavrilov Ilia)
- wifi: mt76: Add check for devm_kstrdup() (Haoxiang Li)
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup (Alexandre Torgue)
- mtd: Replace kcalloc() with devm_kcalloc() (Jiasheng Jiang)
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family (Marek Behún)
- mtd: Add check for devm_kcalloc() (Jiasheng Jiang)
- mptcp: sockopt: fix getting freebind &amp; transparent (Matthieu Baerts (NGI0))
- mptcp: sockopt: fix getting IPV6_V6ONLY (Matthieu Baerts (NGI0))
- media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster (Jackson.lee)
- media: chips-media: wave5: Fix a hang after seeking (Jackson.lee)
- media: chips-media: wave5: Avoid race condition in the interrupt handler (Jackson.lee)
- media: chips-media: wave5: Fix gray color on screen (Jackson.lee)
- media: i2c: imx214: Rectify probe error handling related to runtime PM (Sakari Ailus)
- media: i2c: imx219: Rectify runtime PM handling in probe and remove (Sakari Ailus)
- media: i2c: imx319: Rectify runtime PM handling probe and remove (Sakari Ailus)
- media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia)
- media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia)
- media: nuvoton: Fix reference handling of ece_pdev (Ricardo Ribalda)
- media: nuvoton: Fix reference handling of ece_node (Ricardo Ribalda)
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO (Sakari Ailus)
- media: i2c: ov7251: Set enable GPIO low in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in probe (Sakari Ailus)
- media: i2c: ccs: Set the device's runtime PM status correctly in remove (Sakari Ailus)
- Revert "media: imx214: Fix the error handling in imx214_probe()" (Sakari Ailus)
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() (Karina Yankevich)
- media: imx219: Adjust PLL settings based on the number of MIPI lanes (Dave Stevenson)
- media: platform: stm32: Add check for clk_enable() (Jiasheng Jiang)
- media: visl: Fix ERANGE error when setting enum controls (Nicolas Dufresne)
- media: hi556: Fix memory leak (on error) in hi556_check_hwcfg() (Hans de Goede)
- media: streamzap: prevent processing IR data on URB failure (Murad Masimov)
- accel/ivpu: Fix PM related deadlocks in MS IOCTLs (Jacek Lawrynowicz)
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status (Jonathan McDowell)
- mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu)
- spi: cadence-qspi: Fix probe on AM62A LP SK (Miquel Raynal)
- KVM: arm64: Tear down vGIC on failed vCPU creation (Will Deacon)
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Douglas Anderson)
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Douglas Anderson)
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Douglas Anderson)
- arm64: cputype: Add MIDR_CORTEX_A76AE (Douglas Anderson)
- xenfs/xensyms: respect hypervisor's "next" indication (Jan Beulich)
- media: rockchip: rga: fix rga offset lookup (John Keeping)
- media: siano: Fix error handling in smsdvb_module_init() (Yuan Can)
- media: vim2m: print device name after registering device (Matthew Majewski)
- media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia)
- media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia)
- media: intel/ipu6: set the dev_parent of video device to pdev (Bingbu Cao)
- media: mgb4: Fix switched CMT frequency range "magic values" sets (Martin Tůma)
- media: i2c: adv748x: Fix test pattern selection mask (Niklas Söderlund)
- media: mgb4: Fix CMT registers update logic (Martin Tůma)
- media: uapi: rkisp1-config: Fix typo in extensible params example (Niklas Söderlund)
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems (Alain Volmat)
- auxdisplay: hd44780: Fix an API misuse in hd44780.c (Haoxiang Li)
- HID: pidff: Fix set_device_control() (Tomasz Pakuła)
- HID: pidff: Fix 90 degrees direction name North -&gt; East (Tomasz Pakuła)
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff (Tomasz Pakuła)
- HID: pidff: Clamp effect playback LOOP_COUNT value (Tomasz Pakuła)
- HID: pidff: Rename two functions to align them with naming convention (Tomasz Pakuła)
- HID: pidff: Remove redundant call to pidff_find_special_keys (Tomasz Pakuła)
- HID: pidff: Support device error response from PID_BLOCK_LOAD (Tomasz Pakuła)
- HID: pidff: Comment and code style update (Tomasz Pakuła)
- HID: hid-universal-pidff: Add Asetek wheelbases support (Tomasz Pakuła)
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła)
- HID: pidff: Factor out pool report fetch and remove excess declaration (Tomasz Pakuła)
- HID: pidff: Use macros instead of hardcoded min/max values for shorts (Tomasz Pakuła)
- HID: pidff: Simplify pidff_rescale_signed (Tomasz Pakuła)
- HID: pidff: Move all hid-pidff definitions to a dedicated header (Tomasz Pakuła)
- HID: pidff: Factor out code for setting gain (Tomasz Pakuła)
- HID: pidff: Rescale time values to match field units (Tomasz Pakuła)
- HID: pidff: Define values used in pidff_find_special_fields (Tomasz Pakuła)
- HID: pidff: Simplify pidff_upload_effect function (Tomasz Pakuła)
- HID: pidff: Completely rework and fix pidff_reset function (Tomasz Pakuła)
- HID: pidff: Stop all effects before enabling actuators (Tomasz Pakuła)
- HID: pidff: Clamp PERIODIC effect period to device's logical range (Tomasz Pakuła)
- s390/pci: Fix s390_mmio_read/write syscall page fault handling (Niklas Schnelle)
- ext4: don't treat fhandle lookup of ea_inode as FS corruption (Jann Horn)
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags (Willem de Bruijn)
- erofs: set error to bio if file-backed IO fails (Sheng Yong)
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Uwe Kleine-König)
- pwm: rcar: Improve register calculation (Uwe Kleine-König)
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf)
- tpm: End any active auth session before shutdown (Jonathan McDowell)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (Jonathan McDowell)
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories (Ayush Jain)
- tracing: probe-events: Add comments about entry data storing code (Masami Hiramatsu (Google))
- fbdev: omapfb: Add 'plane' value check (Leonid Arapov)
- drm/amdgpu: grab an additional reference on the gang fence v2 (Christian König)
- drm/amdgpu: Fix the race condition for draining retry fault (Emily Deng)
- PCI: Enable Configuration RRS SV early (Bjorn Helgaas)
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() (Wentao Liang)
- PCI: Add Rockchip Vendor ID (Shawn Lin)
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data (AngeloGioacchino Del Regno)
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds (Tvrtko Ursulin)
- drm/amdkfd: debugfs hang_hws skip GPU with MES (Philip Yang)
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset (Philip Yang)
- drm/amdkfd: Fix mode1 reset crash issue (Philip Yang)
- drm/amdkfd: clamp queue size to minimum (David Yat Sin)
- drivers: base: devres: Allow to release group on device release (Lucas De Marchi)
- drm/amd/display: stop DML2 from removing pipes based on planes (Mike Katsnelson)
- drm/bridge: panel: forbid initializing a panel with unknown connector type (Luca Ceresoli)
- drm/debugfs: fix printk format for bridge index (Luca Ceresoli)
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) (Andrew Wyatt)
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2 (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide (Andrew Wyatt)
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB (Andrew Wyatt)
- drm: panel-orientation-quirks: Add support for AYANEO 2S (Andrew Wyatt)
- drm/amdgpu: Unlocked unmap only clear page table leaves (Philip Yang)
- drm/amd/display: Update Cursor request mode to the beginning prefetch always (Zhikai Zhai)
- drm/xe/vf: Don't try to trigger a full GT reset if VF (Michal Wajdeczko)
- drm/xe/bmg: Add new PCI IDs (Shekhar Chauhan)
- drm: allow encoder mode_set even when connectors change for crtc (Abhinav Kumar)
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE (Pedro Nishiyama)
- Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama)
- Bluetooth: qca: simplify WCN399x NVM loading (Dmitry Baryshkov)
- Bluetooth: hci_qca: use the power sequencer for wcn6750 (Janaki Ramaiah Thota)
- Bluetooth: btusb: Add 2 HWIDs for MT7922 (Jiande Lu)
- Bluetooth: hci_uart: fix race during initialization (Arseniy Krasnov)
- Bluetooth: btintel_pcie: Add device id of Whale Peak (Kiran K)
- tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER (Gabriele Paoloni)
- net: vlan: don't propagate flags on open (Stanislav Fomichev)
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table (Icenowy Zheng)
- btrfs: harden block_group::bg_list against list_del() races (Boris Burkov)
- ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI (Huacai Chen)
- scsi: st: Fix array overflow in st_setup() (Kai Mäkisara)
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk (Philipp Hahn)
- ext4: ignore xattrs past end (Bhupesh)
- Revert "f2fs: rebuild nat_bits during umount" (Chao Yu)
- ext4: protect ext4_release_dquot against freezing (Ojaswin Mujoo)
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller (Daniel Kral)
- net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module (Martin Schiller)
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu)
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (Manish Dharanenthiran)
- net: sfp: add quirk for 2.5G OEM BX SFP (Birger Koblitz)
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode (Niklas Cassel)
- jfs: add sanity check for agwidth in dbMount (Edward Adam Davis)
- jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis)
- fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb)
- fs/jfs: cast inactags to s64 to prevent potential overflow (Rand Deeb)
- jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han)
- can: flexcan: add NXP S32G2/S32G3 SoC support (Ciprian Marian Costea)
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes (Ciprian Marian Costea)
- page_pool: avoid infinite loop to schedule delayed worker (Jason Xing)
- net: usb: asix_devices: add FiberGecko DeviceID (Max Schulze)
- scsi: target: spc: Fix RSOC parameter data header size (Chaohai Chen)
- wifi: mac80211: ensure sdata-&gt;work is canceled before initialized. (Miri Korenblit)
- wifi: mac80211: add strict mode disabling workarounds (Johannes Berg)
- f2fs: don't retry IO for corrupted data scenario (Chao Yu)
- net: page_pool: don't cast mp param to devmem (Pavel Begunkov)
- ata: libata-core: Add 'external' to the libata.force kernel parameter (Niklas Cassel)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- wifi: ath12k: fix memory leak in ath12k_pci_remove() (Miaoqing Pan)
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (Miaoqing Pan)
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues (P Praneesh)
- platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig (Hans de Goede)
- ASoC: amd: yc: update quirk data for new Lenovo model (Syed Saba kareem)
- ASoC: amd: Add DMI quirk for ACP6X mic support (keenplify)
- ALSA: usb-audio: Fix CME quirk for UF series keyboards (Ricard Wanderlof)
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves (Kaustabh Chakraborty)
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes (Aakarsh Jain)
- media: uvcvideo: Add quirk for Actions UVC05 (Ricardo Ribalda)
- ASoC: fsl_audmix: register card device depends on 'dais' property (Shengjiu Wang)
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist (Maxim Mikityanskiy)
- ALSA: hda: intel: Fix Optimus when GPU has no sound (Maxim Mikityanskiy)
- ASoC: amd: ps: use macro for ACP6.3 pci revision id (Vijendar Mukunda)
- HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła)
- HID: pidff: Add PERIODIC_SINE_ONLY quirk (Tomasz Pakuła)
- HID: Add hid-universal-pidff driver and supported device ids (Tomasz Pakuła)
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk (Tomasz Pakuła)
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol (Tomasz Pakuła)
- HID: pidff: Add PERMISSIVE_CONTROL quirk (Tomasz Pakuła)
- HID: pidff: Add MISSING_PBO quirk and its detection (Tomasz Pakuła)
- HID: pidff: Add MISSING_DELAY quirk and its detection (Tomasz Pakuła)
- HID: pidff: Do not send effect envelope if it's empty (Tomasz Pakuła)
- HID: pidff: Convert infinite length from Linux API to PID standard (Tomasz Pakuła)
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc() (Zhang Heng)
- platform/chrome: cros_ec_lpc: Match on Framework ACPI device (Daniel Schaefer)
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault (Ingo Molnar)
- xen/mcelog: Add __nonstring annotations for unterminated strings (Kees Cook)
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD (Douglas Anderson)
- Flush console log from kernel_power_off() (Paul E. McKenney)
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() (Lizhi Xu)
- perf/dwc_pcie: fix some unreleased resources (Yunhui Cui)
- perf: arm_pmu: Don't disable counter in armpmu_add() (Mark Rutland)
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine (Max Grobecker)
- x86/ia32: Leave NULL selector values 0~3 unchanged (Xin Li (Intel))
- x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC &lt; 14.2 (Uros Bizjak)
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW (Matthew Wilcox (Oracle))
- pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han)
- umount: Allow superblock owners to force umount (Trond Myklebust)
- fs: consistently deref the files table with rcu_dereference_raw() (Mateusz Guzik)
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (Louis-Alexis Eyraud)
- iommu/exynos: Fix suspend/resume with IDENTITY domain (Marek Szyprowski)
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet (Florian Westphal)
- net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte)
- ipv6: Align behavior across nexthops during path selection (Ido Schimmel)
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY (Vladimir Oltean)
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() (Vladimir Oltean)
- smb: client: fix UAF in decryption with multichannel (Paulo Alcantara)
- net_sched: sch_sfq: move the limit validation (Octavian Purdila)
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
- nvmet-fcloop: swap list_add_tail arguments (Daniel Wagner)
- drm/i915/huc: Fix fence not released on early probe errors (Janusz Krzysztofik)
- ata: sata_sx4: Add error handling in pdc20621_i2c_read() (Wentao Liang)
- net: libwx: handle page_pool_dev_alloc_pages error (Chenyuan Yang)
- drm/tests: probe-helper: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: modes: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: cmdline: Fix drm_display_mode memory leak (Maxime Ripard)
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode (Maxime Ripard)
- drm/tests: modeset: Fix drm_display_mode memory leak (Maxime Ripard)
- net: ethtool: Don't call .cleanup_data when prepare_data fails (Maxime Chevallier)
- tc: Ensure we have enough buffer space when sending filter netlink notifications (Toke Høiland-Jørgensen)
- octeontx2-pf: qos: fix VF root node parent queue index (Hariprasad Kelam)
- net: tls: explicitly disallow disconnect (Jakub Kicinski)
- codel: remove sch-&gt;q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang)
- tipc: fix memory leak in tipc_link_xmit (Tung Nguyen)
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret() (Josh Poimboeuf)
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin)
- drm/xe/hw_engine: define sysfs_ops on all directories (Tejas Upadhyay)
- x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI (Petr Vaněk)
- drm/i915: Disable RPG during live selftest (Badal Nilawar)
- ublk: fix handling recovery &amp; reissue in ublk_abort_queue() (Ming Lei)
- ublk: refactor recovery configuration flag helpers (Uday Shankar)
- selftests/futex: futex_waitv wouldblock test should fail (Edward Liaw)
- gpiolib: of: Fix the choice for Ingenic NAND quirk (Andy Shevchenko)
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set (Waiman Long)
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long)
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long)
- cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long)
- cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long)
- ASoC: Intel: adl: add 2xrt1316 audio configuration (Bard Liao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.27.2.el10uek]" date="1746619200">- LTS version: v6.12.27 (Jack Vogel)
- bpf: Fix BPF_INTERNAL namespace import (Xi Ruoyao)
- LTS version: v6.12.26 (Jack Vogel)
- mq-deadline: don't call req_get_ioprio from the I/O completion handler (Christoph Hellwig)
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size (Keerthy)
- crypto: Kconfig - Select LIB generic option (Herbert Xu)
- usb: typec: class: Unlocked on error in typec_register_partner() (Dan Carpenter)
- objtool: Silence more KCOV warnings, part 2 (Josh Poimboeuf)
- objtool: Ignore end-of-section jumps for KCOV/GCOV (Josh Poimboeuf)
- usb: xhci: Fix Short Packet handling rework ignoring errors (Michal Pecio)
- nvme: fixup scan failure for non-ANA multipath controllers (Hannes Reinecke)
- MIPS: cm: Fix warning if MIPS_CM is disabled (Thomas Bogendoerfer)
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() (Dan Carpenter)
- crypto: lib/Kconfig - Hide arch options from user (Herbert Xu)
- iommu: Handle race with default domain setup (Robin Murphy)
- net: dsa: mv88e6xxx: enable STU methods for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: enable PVT for 6321 switch (Marek Behún)
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family (Marek Behún)
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family" (Marek Behún)
- usb: typec: class: Invalidate USB device pointers on partner unregistration (Andrei Kuchynski)
- ext4: goto right label 'out_mmap_sem' in ext4_setattr() (Baokun Li)
- comedi: jr3_pci: Fix synchronous deletion of timer (Ian Abbott)
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (Daniel Borkmann)
- usb: typec: class: Fix NULL pointer access (Andrei Kuchynski)
- selftests/bpf: Adjust data size to have ETH_HLEN (Shigeru Yoshida)
- selftests/bpf: check program redirect in xdp_cpumap_attach (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached (Alexis Lothoré (eBPF Foundation))
- selftests/bpf: fix bpf_map_redirect call for cpu map test (Alexis Lothoré (eBPF Foundation))
- xfs: flush inodegc before swapon (Christoph Hellwig)
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate (Christoph Hellwig)
- xfs: Do not allow norecovery mount with quotacheck (Carlos Maiolino)
- xfs: do not check NEEDSREPAIR if ro,norecovery mount. (Lukas Herbolt)
- driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov)
- driver core: introduce device_set_driver() helper (Dmitry Torokhov)
- Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov)
- spi: spi-imx: Add check for spi_imx_setupxfer() (Tamura Dai)
- drm/amdgpu: Use the right function for hdp flush (Lijo Lazar)
- drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4 (Christian König)
- md/raid1: Add check for missing source disk in process_checks() (Meir Elisha)
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (Pi Xiange)
- ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)
- spi: tegra210-quad: add rate limiting and simplify timeout error message (Breno Leitao)
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Breno Leitao)
- ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" (Namjae Jeon)
- riscv: Provide all alternative macros all the time (Andrew Jones)
- iomap: skip unnecessary ifs_block_is_uptodate check (Gou Hao)
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (Song Liu)
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled (Fernando Fernandez Mancera)
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend (Shengjiu Wang)
- scsi: pm80xx: Set phy_attached to zero when device is gone (Igor Pylypiv)
- scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend() (Peter Griffin)
- scsi: ufs: exynos: Move phy calls to .exit() callback (Peter Griffin)
- scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO (Peter Griffin)
- scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init() (Peter Griffin)
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes (Xingui Yang)
- ext4: make block validity check resistent to sb bh corruption (Ojaswin Mujoo)
- iommu: Clear iommu-dma ops on cleanup (Robin Murphy)
- cifs: Fix querying of WSL CHR and BLK reparse points over SMB1 (Pali Rohár)
- timekeeping: Add a lockdep override in tick_freeze() (Sebastian Andrzej Siewior)
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode (Pali Rohár)
- nvmet-fc: put ref when assoc-&gt;del_work is already scheduled (Daniel Wagner)
- nvmet-fc: take tgtport reference only once (Daniel Wagner)
- x86/bugs: Don't fill RSB on context switch with eIBRS (Josh Poimboeuf)
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Josh Poimboeuf)
- x86/bugs: Use SBPB in write_ibpb() if applicable (Josh Poimboeuf)
- selftests/mincore: Allow read-ahead pages to reach the end of the file (Qiuxu Zhuo)
- x86/xen: disable CPU idle and frequency drivers for PVH dom0 (Roger Pau Monne)
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment (Andy Shevchenko)
- objtool: Stop UNRET validation on UD2 (Josh Poimboeuf)
- nvme: multipath: fix return value of nvme_available_path (Uday Shankar)
- nvme: re-read ANA log page after ns scan completes (Hannes Reinecke)
- drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406 (Julia Filipchuk)
- drm/amdgpu: Increase KIQ invalidate_tlbs timeout (Jay Cornwall)
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls (Jean-Marc Eurin)
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S (Mario Limonciello)
- nvme: requeue namespace scan on missed AENs (Hannes Reinecke)
- xen: Change xen-acpi-processor dom0 dependency (Jason Andryuk)
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi)
- selftests: ublk: fix test_stripe_04 (Ming Lei)
- cgroup/cpuset: Don't allow creation of local partition over a remote one (Waiman Long)
- KVM: s390: Don't use %pK through debug printing (Thomas Weißschuh)
- KVM: s390: Don't use %pK through tracepoints (Thomas Weißschuh)
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP (Oleg Nesterov)
- kbuild: add dependency from vmlinux to sorttable (Xi Ruoyao)
- io_uring: always do atomic put from iowq (Pavel Begunkov)
- rtc: pcf85063: do a SW reset if POR failed (Lukas Stockmann)
- 9p/trans_fd: mark concurrent read and writes to p9_conn-&gt;err (Ignacio Encinas)
- 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet)
- ntb_hw_amd: Add NTB PCI ID for new gen CPU (Basavaraj Natikar)
- ntb: reduce stack usage in idt_scan_mws (Arnd Bergmann)
- qibfs: fix _another_ leak (Al Viro)
- objtool, lkdtm: Obfuscate the do_nothing() pointer (Josh Poimboeuf)
- objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() (Josh Poimboeuf)
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() (Josh Poimboeuf)
- objtool, panic: Disable SMAP in __stack_chk_fail() (Josh Poimboeuf)
- objtool: Silence more KCOV warnings (Josh Poimboeuf)
- um: work around sched_yield not yielding in time-travel mode (Benjamin Berg)
- thunderbolt: Scan retimers after device router has been enumerated (Mika Westerberg)
- usb: host: xhci-plat: mvebu: use -&gt;quirks instead of -&gt;init_quirk() func (Théo Lebrun)
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang)
- phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init (Andy Yan)
- usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running (Michal Pecio)
- dmaengine: dmatest: Fix dmatest waiting less when interrupted (Vinicius Costa Gomes)
- i3c: master: svc: Add support for Nuvoton npcm845 i3c (Stanley Chu)
- xhci: Handle spurious events on Etron host isoc enpoints (Mathias Nyman)
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Michal Pecio)
- usb: xhci: Complete 'error mid TD' transfers when handling Missed Service (Michal Pecio)
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs (John Stultz)
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield (Andy Shevchenko)
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints (Andy Shevchenko)
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size (Edward Adam Davis)
- fs/ntfs3: Keep write operations atomic (Lizhi Xu)
- usb: host: max3421-hcd: Add missing spi_device_id table (Alexander Stein)
- mailbox: pcc: Always clear the platform ack interrupt first (Sudeep Holla)
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag (Huisong Li)
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions (Yafang Shao)
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage (Martin KaFai Lau)
- bpf: bpftool: Setting error code in do_loader() (Sewon Nam)
- s390/tty: Fix a potential memory leak bug (Haoxiang Li)
- s390/sclp: Add check for get_zeroed_page() (Haoxiang Li)
- parisc: PDT: Fix missing prototype warning (Yu-Chun Lin)
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() (Heiko Stuebner)
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov)
- bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song)
- crypto: null - Use spin lock instead of mutex (Herbert Xu)
- crypto: lib/Kconfig - Fix lib built-in failure when arch is modular (Herbert Xu)
- crypto: ccp - Add support for PCI device 0x1134 (Devaraj Rangasamy)
- MIPS: cm: Detect CM quirks from device tree (Gregory CLEMENT)
- pinctrl: mcp23s08: Get rid of spurious level interrupts (Dmitry Mastykin)
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference (Chenyuan Yang)
- selftests/bpf: Fix stdout race condition in traffic monitor (Amery Hung)
- USB: wdm: add annotation (Oliver Neukum)
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context (Oliver Neukum)
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop (Oliver Neukum)
- USB: wdm: handle IO errors in wdm_wwan_port_start (Oliver Neukum)
- USB: VLI disk crashes if LPM is used (Oliver Neukum)
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive (Miao Li)
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive (Miao Li)
- usb: dwc3: xilinx: Prevent spike in reset signal (Mike Looijmans)
- usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen)
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) (Huacai Chen)
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines (Fedor Pchelkin)
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling (Fedor Pchelkin)
- usb: cdns3: Fix deadlock when using NCM gadget (Ralph Siemsen)
- usb: xhci: Fix invalid pointer dereference in Etron workaround (Michal Pecio)
- xhci: Limit time spent with xHC interrupts disabled during bus resume (Mathias Nyman)
- USB: serial: simple: add OWON HDS200 series oscilloscope support (Craig Hesling)
- USB: serial: option: add Sierra Wireless EM9291 (Adam Xue)
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe (Michael Ehrenreich)
- serial: sifive: lock port in startup()/shutdown() callbacks (Ryo Takakura)
- serial: msm: Configure correct working mode before starting earlycon (Stephan Gerhold)
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (Günther Noack)
- firmware: stratix10-svc: Add of_platform_default_populate() (Mahesh Rao)
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack (Rengarajan S)
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration (Rengarajan S)
- char: misc: register chrdev region with all possible minors (Thadeu Lima de Souza Cascardo)
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson)
- KVM: x86: Reset IRTE to host control if *new* route isn't postable (Sean Christopherson)
- KVM: x86: Explicitly treat routing entry type changes as changes (Sean Christopherson)
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use (Hans de Goede)
- mei: me: add panther lake H DID (Alexander Usyskin)
- scsi: Improve CDL control (Damien Le Moal)
- USB: storage: quirk for ADATA Portable HDD CH94 (Oliver Neukum)
- ata: libata-scsi: Fix ata_msense_control_ata_feature() (Damien Le Moal)
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type (Damien Le Moal)
- ata: libata-scsi: Improve CDL control (Damien Le Moal)
- mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li)
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports (Smita Koralahalli)
- KVM: SVM: Allocate IR data using atomic allocation (Sean Christopherson)
- io_uring: fix 'sync' handling of io_fallback_tw() (Jens Axboe)
- LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally (Bibo Mao)
- LoongArch: KVM: Fully clear some CSRs when VM reboot (Bibo Mao)
- LoongArch: Remove a bogus reference to ZONE_DMA (Petr Tesarik)
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD (Ming Wang)
- LoongArch: Handle fp, lsx, lasx and lbt assembly symbols (Tiezhu Yang)
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (Suzuki K Poulose)
- x86/insn: Fix CTEST instruction decoding (Kirill A. Shutemov)
- drm/amd/display: Force full update in gpu reset (Roman Li)
- drm/amd/display: Fix gpu reset in multidisplay config (Roman Li)
- drm: panel: jd9365da: fix reset signal polarity in unprepare (Hugo Villeneuve)
- rust: firmware: Use `ffi::c_char` type in `FwFunc` (Christian Schrefl)
- net: phy: microchip: force IRQ polling mode for lan88xx (Fiona Klute)
- net: selftests: initialize TCP header and skb payload with zero (Oleksij Rempel)
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (Alexey Nepomnyashih)
- crypto: atmel-sha204a - Set hwrng quality to lowest possible (Marek Behún)
- sched_ext: Use kvzalloc for large exit_dump allocation (Breno Leitao)
- virtio_console: fix missing byte order handling for cols and rows (Halil Pasic)
- netfilter: fib: avoid lookup if socket is available (Florian Westphal)
- LoongArch: Make do_xyz() exception handlers more robust (Tiezhu Yang)
- LoongArch: Make regs_irqs_disabled() more clear (Tiezhu Yang)
- LoongArch: Select ARCH_USE_MEMTEST (Yuli Wang)
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (Luo Gengkun)
- bpf: Add namespace to BPF internal symbols (Alexei Starovoitov)
- splice: remove duplicate noinline from pipe_clear_nowait (T.J. Mercier)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE (Sean Christopherson)
- block: never reduce ra_pages in blk_apply_bdi_limits (Christoph Hellwig)
- pds_core: make wait_context part of q_info (Shannon Nelson)
- pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley)
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley)
- pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley)
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang)
- net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang)
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (Al Viro)
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration (Bo-Cun Chen)
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen)
- net: phy: leds: fix memory leak (Qingfang Deng)
- net: lwtunnel: disable BHs when required (Justin Iurman)
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() (Chenyuan Yang)
- scsi: core: Clear flags for scsi_cmnd that did not complete (Anastasia Kovaleva)
- net/mlx5: Move ttc allocation after switch case to prevent leaks (Henry Martin)
- net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin)
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode (T.J. Mercier)
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (Johannes Thumshirn)
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range() (Qu Wenruo)
- cpufreq: fix compile-test defaults (Johan Hovold)
- cpufreq: Do not enable by default during compile testing (Krzysztof Kozlowski)
- cpufreq: cppc: Fix invalid return value in .get() callback (Marc Zyngier)
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() (Chenyuan Yang)
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin)
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin)
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (Henry Martin)
- dma/contiguous: avoid warning about unused size_bytes (Arnd Bergmann)
- cpufreq: sun50i: prevent out-of-bounds access (Andre Przywara)
- ceph: Fix incorrect flush end position calculation (David Howells)
- lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP (Nathan Chancellor)
- drm/amd/display/dml2: use vzalloc rather than kzalloc (Alex Deucher)
- drm/amd/display: Fix unnecessary cast warnings from checkpatch (Rohit Chavan)
- drm/xe/bmg: Add one additional PCI ID (Matt Roper)
- net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier)
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set (Peter Griffin)
- scsi: ufs: exynos: Move UFS shareability value to drvdata (Peter Griffin)
- scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster (Peter Griffin)
- scsi: ufs: exynos: Remove superfluous function parameter (Tudor Ambarus)
- scsi: ufs: exynos: Remove empty drv_init method (Tudor Ambarus)
- ksmbd: fix use-after-free in __smb2_lease_break_noti() (Namjae Jeon)
- ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL (Namjae Jeon)
- ksmbd: add netdev-up/down event debug print (Namjae Jeon)
- ksmbd: use __GFP_RETRY_MAYFAIL (Namjae Jeon)
- accel/ivpu: Fix the NPU's DPU frequency calculation (Andrzej Kacprowski)
- accel/ivpu: Add auto selection logic for job scheduler (Jacek Lawrynowicz)
- PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads (Jonathan Currier)
- PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends (Thomas Gleixner)
- PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag (Roger Pau Monne)
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- of: resolver: Fix device node refcount leakage in of_resolve_phandles() (Zijun Hu)
- of: resolver: Simplify of_resolve_phandles() using __free() (Rob Herring (Arm))
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks (Siddharth Vadapalli)
- arm64: dts: ti: Refactor J784s4 SoC files to a common file (Manorit Chawdhry)
- iio: adc: ad7768-1: Fix conversion result sign (Sergiu Cuciurean)
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check (Jonathan Cameron)
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family (Marek Behún)
- media: ov08x40: Add missing ov08x40_identify_module() call on stream-start (Hans de Goede)
- media: ov08x40: Move ov08x40_identify_module() function up (Hans de Goede)
- media: i2c: imx214: Fix link frequency validation (André Apitzsch)
- media: i2c: imx214: Check number of lanes from device tree (André Apitzsch)
- media: i2c: imx214: Replace register addresses with macros (André Apitzsch)
- media: i2c: imx214: Convert to CCI register access helpers (André Apitzsch)
- media: i2c: imx214: Simplify with dev_err_probe() (André Apitzsch)
- media: i2c: imx214: Use subdev active state (André Apitzsch)
- PM: EM: Address RCU-related sparse warnings (Rafael J. Wysocki)
- PM: EM: use kfree_rcu() to simplify the code (Li RongQing)
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get (Tudor Ambarus)
- soc: qcom: ice: introduce devm_of_qcom_ice_get (Tudor Ambarus)
- mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu)
- tracing: Verify event formats that have "%*p.." (Steven Rostedt)
- tracing: Add __print_dynamic_array() helper (Steven Rostedt)
- module: sign with sha512 instead of sha1 by default (Thorsten Leemhuis)
- LTS version: v6.12.25 (Jack Vogel)
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms (Eduard Zingerman)
- bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs (Eduard Zingerman)
- selftests/bpf: validate that tail call invalidates packet pointers (Eduard Zingerman)
- selftests/bpf: freplace tests for tracking of changes_packet_data (Eduard Zingerman)
- bpf: check changes_pkt_data property for extension programs (Eduard Zingerman)
- selftests/bpf: test for changing packet data from global functions (Eduard Zingerman)
- bpf: track changes_pkt_data property for global functions (Eduard Zingerman)
- bpf: add find_containing_subprog() utility function (Eduard Zingerman)
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process (P Praneesh)
- MIPS: ds1287: Match ds1287_set_base_clock() function types (WangYuli)
- MIPS: cevt-ds1287: Add missing ds1287.h include (WangYuli)
- MIPS: dec: Declare which_prom() as static (WangYuli)
- Revert "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process" (Alexander Tsoy)
- mm/vma: add give_up_on_oom option on modify/merge, use in uffd release (Lorenzo Stoakes)
- nvmet-fc: Remove unused functions (WangYuli)
- drm/amd/display: Temporarily disable hostvm on DCN31 (Aurabindo Pillai)
- LoongArch: Eliminate superfluous get_numa_distances_cnt() (Yuli Wang)
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32 (Hamza Mahfooz)
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type (Kunihiko Hayashi)
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi)
- selftests/bpf: Fix raw_tp null handling test (Shung-Hsi Yu)
- md: fix mddev uaf while iterating all_mddevs list (Yu Kuai)
- platform/x86: msi-wmi-platform: Workaround a ACPI firmware bug (Armin Wolf)
- platform/x86: msi-wmi-platform: Rename "data" variable (Armin Wolf)
- kbuild: Add '-fno-builtin-wcslen' (Nathan Chancellor)
- scripts: generate_rust_analyzer: Add ffi crate (Lukas Fischer)
- cpufreq: Reference count policy in cpufreq_update_limits() (Rafael J. Wysocki)
- arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HFGITR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGWTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Add register fields for HDFGRTR2_EL2 (Anshuman Khandual)
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 (Anshuman Khandual)
- drm/mgag200: Fix value in &lt;VBLKSTR&gt; register (Thomas Zimmermann)
- drm/amdgpu: fix warning of drm_mm_clean (ZhenGuo Yin)
- drm/xe: Set LRC addresses before guc load (Lucas De Marchi)
- drm/xe/userptr: fix notifier vs folio deadlock (Matthew Auld)
- drm/xe/dma_buf: stop relying on placement in unmap (Matthew Auld)
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/amd/display: Protect FPU in dml2_init()/dml21_init() (Huacai Chen)
- drm/amd/display: Do not enable Replay and PSR while VRR is on in amdgpu_dm_commit_planes() (Tom Chung)
- drm/amdgpu: immediately use GTT for new allocations (Christian König)
- drm/i915/gvt: fix unterminated-string-initialization warning (Jani Nikula)
- drm/xe: Fix an out-of-bounds shift when invalidating TLB (Thomas Hellström)
- drm/sti: remove duplicate object names (Rolf Eike Beer)
- drm/imagination: take paired job reference (Brendan King)
- drm/imagination: fix firmware memory leaks (Brendan King)
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge)
- drm/amdgpu/dma_buf: fix page_link check (Matthew Auld)
- drm/amdgpu/mes11: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/display: Protect FPU in dml21_copy() (Huacai Chen)
- drm/amd/display: Protect FPU in dml2_validate()/dml21_validate() (Huacai Chen)
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1 (Mario Limonciello)
- drm/xe: Use local fence in error path of xe_migrate_clear (Matthew Brost)
- drm/i915/vrr: Add vrr.vsync_{start, end} in vrr_params_changed (Ankit Nautiyal)
- drm/amdgpu/mes12: optimize MES pipe FW version fetching (Alex Deucher)
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero (Denis Arefev)
- drm/amd/pm/smu11: Prevent division by zero (Denis Arefev)
- drm/amd/pm/powerplay: Prevent division by zero (Denis Arefev)
- drm/amd/pm: Prevent division by zero (Denis Arefev)
- drm/amd/display: Increase vblank offdelay for PSR panels (Leo Li)
- drm/amd/display: Actually do immediate vblank disable (Leo Li)
- drm/amd: Handle being compiled without SI or CIK support better (Mario Limonciello)
- drm/amd/display: prevent hang on link training fail (Brendan Tam)
- drm/amdgpu: Prefer shadow rom when available (Lijo Lazar)
- drm/msm/a6xx: Fix stale rpmh votes from GPU (Akhil P Oommen)
- drm/msm/dsi: Add check for devm_kstrdup() (Haoxiang Li)
- drm/ast: Fix ast_dp connection status (Jocelyn Falempe)
- drm/repaper: fix integer overflows in repeat functions (Nikita Zhandarovich)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Kan Liang)
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Kan Liang)
- perf/x86/intel: Allow to update user space GPRs from PEBS records (Dapeng Mi)
- platform/x86: amd: pmf: Fix STT limits (Mario Limonciello)
- RAS/AMD/FMPM: Get masked address (Yazen Ghannam)
- RAS/AMD/ATL: Include row[13] bit in row retirement (Yazen Ghannam)
- scsi: ufs: exynos: Ensure consistent phy reference counts (Peter Griffin)
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry (Chandrakanth Patil)
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (Ard Biesheuvel)
- x86/cpu/amd: Fix workaround for erratum 1054 (Sandipan Das)
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (Borislav Petkov (AMD))
- virtiofs: add filesystem context source name check (Xiangsheng Hou)
- tracing: Fix filter string testing (Steven Rostedt)
- string: Add load_unaligned_zeropad() code path to sized_strscpy() (Peter Collingbourne)
- smb3 client: fix open hardlink on deferred close file error (Chunjie Zhu)
- slab: ensure slab-&gt;obj_exts is clear in a newly allocated slab page (Suren Baghdasaryan)
- selftests/mm: generate a temporary mountpoint for cgroup filesystem (Mark Brown)
- riscv: Avoid fortify warning in syscall_get_arguments() (Nathan Chancellor)
- Revert "smb: client: fix TCP timers deadlock after rmmod" (Kuniyuki Iwashima)
- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Kuniyuki Iwashima)
- ksmbd: fix the warning from __kernel_write_iter (Namjae Jeon)
- ksmbd: Prevent integer overflow in calculation of deadtime (Denis Arefev)
- ksmbd: fix use-after-free in smb_break_all_levII_oplock() (Namjae Jeon)
- ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
- ovl: don't allow datadir only (Miklos Szeredi)
- mm: fix apply_to_existing_page_range() (Kirill A. Shutemov)
- mm: fix filemap_get_folios_contig returning batches of identical folios (Vishal Moola (Oracle))
- mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Baoquan He)
- mm/compaction: fix bug in hugetlb handling pathway (Vishal Moola (Oracle))
- loop: LOOP_SET_FD: send uevents for partitions (Thomas Weißschuh)
- loop: properly send KOBJ_CHANGED uevent for disk device (Thomas Weißschuh)
- isofs: Prevent the use of too small fid (Edward Adam Davis)
- i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo)
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev)
- crypto: caam/qi - Fix drv_ctx refcount bug (Herbert Xu)
- cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
- btrfs: correctly escape subvol in btrfs_show_options() (Johannes Kimmel)
- Bluetooth: vhci: Avoid needless snprintf() calls (Kees Cook)
- Bluetooth: l2cap: Process valid commands in too long frame (Frédéric Danis)
- drm/msm/a6xx+: Don't let IB_SIZE overflow (Rob Clark)
- ftrace: fix incorrect hash size in register_ftrace_direct() (Menglong Dong)
- i2c: atr: Fix wrong include (Andy Shevchenko)
- nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng)
- nfs: add missing selections of CONFIG_CRC32 (Eric Biggers)
- dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() (Dan Carpenter)
- drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later (Maíra Canal)
- block: integrity: Do not call set_page_dirty_lock() (Martin K. Petersen)
- asus-laptop: Fix an uninitialized variable (Denis Arefev)
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow (Evgeny Pimenov)
- ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S16 (Peter Ujfalusi)
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels (Srinivas Kandagatla)
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate (Srinivas Kandagatla)
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START event (Herve Codina)
- Revert "PCI: Avoid reset when disabled via sysfs" (Alex Williamson)
- writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher)
- rust: kbuild: use `pound` to support GNU Make &lt; 4.3 (Miguel Ojeda)
- rust: disable `clippy::needless_continue` (Miguel Ojeda)
- rust: kasan/kbuild: fix missing flags on first build (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0 (Miguel Ojeda)
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS (Rafael J. Wysocki)
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break (WangYuli)
- riscv: KGDB: Do not inline arch_kgdb_breakpoint() (WangYuli)
- kunit: qemu_configs: SH: Respect kunit cmdline (Thomas Weißschuh)
- riscv: module: Allocate PLT entries for R_RISCV_PLT32 (Samuel Holland)
- riscv: module: Fix out-of-bounds relocation access (Samuel Holland)
- riscv: Properly export reserved regions in /proc/iomem (Björn Töpel)
- riscv: Use kvmalloc_array on relocation_hashtable (Will Pierce)
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps (Bo-Cun Chen)
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset (Bo-Cun Chen)
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout request (Meghana Malladi)
- net: ti: icss-iep: Add phase offset configuration for perout signal (Meghana Malladi)
- net: ti: icss-iep: Add pwidth configuration for perout signal (Meghana Malladi)
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set (Sagi Maimon)
- net: dsa: avoid refcount warnings when ds-&gt;ops-&gt;tag_8021q_vlan_del() fails (Vladimir Oltean)
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- net: dsa: clean up FDB, MDB, VLAN entries on unbind (Vladimir Oltean)
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported (Vladimir Oltean)
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (Vladimir Oltean)
- net: txgbe: fix memory leak in txgbe_probe() error path (Abdun Nihaal)
- net: bridge: switchdev: do not notify new brentries as changed (Jonas Gorski)
- net: b53: enable BPDU reception for management port (Jonas Gorski)
- netlink: specs: rt-link: adjust mctp attribute naming (Jakub Kicinski)
- netlink: specs: rt-link: add an attr layer around alt-ifname (Jakub Kicinski)
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path (Abdun Nihaal)
- ata: libata-sata: Save all fields from sense data descriptor (Niklas Cassel)
- loop: stop using vfs_iter_{read,write} for buffered I/O (Christoph Hellwig)
- loop: aio inherit the ioprio of original request (Yunlong Xing)
- eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski)
- net: ethernet: ti: am65-cpsw: fix port_np reference counting (Michael Walle)
- net: ngbe: fix memory leak in ngbe_probe() error path (Abdun Nihaal)
- can: rockchip_canfd: fix broken quirks checks (Weizhao Ouyang)
- net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets)
- netlink: specs: ovs_vport: align with C codegen capabilities (Jakub Kicinski)
- block: fix resource leak in blk_register_queue() error path (Zheng Qixing)
- net: mctp: Set SOCK_RCU_FREE (Matt Johnston)
- ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() (Damodharam Ammepalli)
- pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal)
- test suite: use %zu to print size_t (Matthew Wilcox (Oracle))
- smc: Fix lockdep false-positive for IPPROTO_SMC. (Kuniyuki Iwashima)
- dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry (Geert Uytterhoeven)
- igc: add lock preventing multiple simultaneous PTM transactions (Christopher S M Hall)
- igc: cleanup PTP module if probe fails (Christopher S M Hall)
- igc: handle the IGC_PTP_ENABLED flag correctly (Christopher S M Hall)
- igc: move ktime snapshot into PTM retry loop (Christopher S M Hall)
- igc: increase wait time before retrying PTM (Christopher S M Hall)
- igc: fix PTM cycle trigger logic (Christopher S M Hall)
- Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Johannes Berg)
- xen: fix multicall debug feature (Juergen Gross)
- ipv6: add exception routes to GC list in rt6_insert_exception (Xin Long)
- Bluetooth: l2cap: Check encryption key size on incoming connection (Frédéric Danis)
- Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter)
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (Luiz Augusto von Dentz)
- RDMA/core: Silence oversized kvmalloc() warning (Shay Drory)
- ASoC: cs42l43: Reset clamp override on jack removal (Charles Keepax)
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (Kailang Yang)
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 (Takashi Iwai)
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA (Jaroslav Kysela)
- ALSA: hda/cirrus_scodec_test: Don't select dependencies (Richard Fitzgerald)
- RDMA/hns: Fix wrong maximum DMA segment size (Chengchang Tang)
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() (Yue Haibing)
- ovl: remove unused forward declaration (Giuseppe Scrivano)
- crypto: tegra - Fix IV usage for AES ECB (Akhil R)
- crypto: tegra - Do not use fixed size buffers (Akhil R)
- crypto: tegra - remove redundant error check on ret (Colin Ian King)
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() (Henry Martin)
- ASoC: dwc: always enable/disable i2s irqs (Brady Norander)
- md/md-bitmap: fix stats collection for external bitmaps (Zheng Qixing)
- md/raid10: fix missing discard IO accounting (Yu Kuai)
- scsi: iscsi: Fix missing scsi_host_put() in error path (Miaoqian Lin)
- wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal)
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel)
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() (Remi Pommarel)
- wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal)
- scsi: hisi_sas: Enable force phy when SATA disk directly connected (Xingui Yang)
- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump (Brian Maly)  [Orabug: 37446372]
- vhost-scsi: Fix vhost_scsi_send_status() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Fix vhost_scsi_send_bad_target() (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex (Dongli Zhang)  [Orabug: 37840543]
- vhost-scsi: Reduce response iov mem use (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate iov_iter used for unaligned copies when needed (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Stop duplicating se_cmd fields (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Dynamically allocate scatterlists (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Return queue full for page alloc failures during copy (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Add better resource allocation failure handling (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Allocate T10 PI structs only when enabled (Mike Christie)  [Orabug: 37840543]
- vhost-scsi: Reduce mem use by moving upages to per queue (Mike Christie)  [Orabug: 37840543]
- Revert "vhost-scsi: protect vq-&gt;log_base with vq-&gt;mutex" (Mike Christie)  [Orabug: 37840543]
- Revert "vhost_scsi: log write descriptors" (Mike Christie)  [Orabug: 37840543]
- scsi: mpi3mr: Event processing debug improvement (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Add level check to control event logging (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Reset the pending interrupt flag (Ranjan Kumar)  [Orabug: 37878021]
- scsi: mpi3mr: Fix pending I/O counter (Ranjan Kumar)  [Orabug: 37878021]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge)
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi)
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang)
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski)
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang)
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh B Edara)
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan)
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon)
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang)
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein)
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab)
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh AP)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya KN)
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe)
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai)
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Xuanqiang Luo)
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira)
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira)
- pds_core: remove write-after-free of client_id (Shannon Nelson)
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud)
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh B Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu)
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu)
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (e.kubanski)
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel)
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov)
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom)
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Leo Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park)
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan)
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan)
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon)
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen)
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov)
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (LongPing Wei)
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang)
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold)
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson)
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller)
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon)
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner)
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik)
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya)  [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya)  [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil)  [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert)  [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter)  [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King)  [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S)  [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche)  [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert)  [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel)  [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar)  [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang)  [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang)  [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu)  [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli)  [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre)  [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta)  [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon)  [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon)  [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta)  [Orabug: 37945459]  {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth)  [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth)  [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick)  [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli)  [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval)   
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang)  [Orabug: 37967533]  
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed)  [Orabug: 37921776]  
- RDS: use pin_user_pages_fast() (Stephen Brennan)  [Orabug: 37968545]</changelog>
</package>
<package pkgid="55a9a2b4b8a4188033083b6066753faba3ebab32" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="101.33.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-2.28.3.el10uek]" date="1747137600">- LTS version: v6.12.28 (Jack Vogel)
- dm: fix copying after src array boundaries (Tudor Ambarus)
- drm/amd/display: Fix slab-use-after-free in hdcp (Chris Bainbridge) [Orabug: 37976747] {CVE-2025-37903}
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp (Mario Limonciello)
- drivers: base: handle module_kobject creation (Shyam Saini)
- kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
- kernel: param: rename locate_module_kobject (Shyam Saini)
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (Christian Hewitt)
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs (Christian Bruel)
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs (Christian Bruel)
- ARM: dts: opos6ul: add ksz8081 phy properties (Sébastien Szymanski)
- arm64: dts: imx95: Correct the range of PCIe app-reg region (Richard Zhu)
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired (Sudeep Holla)
- firmware: arm_scmi: Balance device refcount when destroying devices (Cristian Marussi) [Orabug: 37976752] {CVE-2025-37905}
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change (Niranjana Vishwanathapura)
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang)
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [Orabug: 37976858] {CVE-2025-37932}
- accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW (Karol Wachowski)
- accel/ivpu: Fix locking order in ivpu_job_submit (Karol Wachowski) [Orabug: 37976760] {CVE-2025-37907}
- accel/ivpu: Abort all jobs after command queue unregister (Karol Wachowski)
- accel/ivpu: Update VPU FW API headers (Andrzej Kacprowski)
- accel/ivpu: Fix a typo (Andrew Kreimer)
- accel/ivpu: Use xa_alloc_cyclic() instead of custom function (Karol Wachowski)
- accel/ivpu: Make DB_ID and JOB_ID allocations incremental (Tomasz Rusinowicz)
- net: Fix the devmem sock opts and msgs for parisc (Pranjal Shrivastava)
- bcachefs: Remove incorrect __counted_by annotation (Alan Huang)
- mm, slab: clean up slab-&gt;obj_exts always (Zhenhua Huang) [Orabug: 37976762] {CVE-2025-37908}
- net: vertexcom: mse102x: Fix RX error handling (Stefan Wahren)
- net: vertexcom: mse102x: Add range check for CMD_RTS (Stefan Wahren)
- net: vertexcom: mse102x: Fix LEN_MASK (Stefan Wahren)
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt (Stefan Wahren)
- net: hns3: defer calling ptp_clock_register() (Jian Shen)
- net: hns3: fixed debugfs tm_qset size (Hao Lan)
- net: hns3: fix an interrupt residual problem (Yonglong Liu)
- net: hns3: store rx VLAN tag offload state for VF (Jian Shen)
- octeon_ep: Fix host hang issue during device reboot (Sathesh Edara) [Orabug: 37976864] {CVE-2025-37933}
- net: fec: ERR007885 Workaround for conventional TX (Mattias Barthel)
- net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan) [Orabug: 37976765] {CVE-2025-37909}
- ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations (Sagi Maimon) [Orabug: 37976771] {CVE-2025-37910}
- net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (Jibin Zhang) [Orabug: 37976728] {CVE-2025-37894}
- bnxt_en: fix module unload sequence (Vadim Fedorenko)
- ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction (Alexander Stein) [Orabug: 37976869] {CVE-2025-37934}
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS (Alistair Francis)
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS (Alistair Francis)
- nvme-tcp: fix premature queue removal and I/O failover (Michael Liang)
- bnxt_en: Fix ethtool -d byte order for 32-bit values (Michael Chan)
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab) [Orabug: 37976773] {CVE-2025-37911}
- bnxt_en: Fix coredump logic to free allocated buffer (Shruti Parab)
- bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings() (Kashyap Desai)
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan() (Somnath Kotur)
- bnxt_en: Fix ethtool selftest output in one of the failure cases (Kalesh Ap)
- bnxt_en: Fix error handling path in bnxt_init_chip() (Shravya Kn) [Orabug: 37976731] {CVE-2025-37895}
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models (Takashi Iwai)
- net: ipv6: fix UDPv6 GSO segmentation with NAT (Felix Fietkau)
- net: dsa: felix: fix broken taprio gate states after clock jump (Vladimir Oltean)
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM (Chad Monroe) [Orabug: 37976872] {CVE-2025-37935}
- igc: fix lock order in igc_ptp_reset (Jacob Keller)
- idpf: protect shutdown from reset (Larysa Zaremba)
- idpf: fix potential memory leak on kcalloc() failure (Michal Swiatkowski)
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy (Da Xue)
- net: dlink: Correct endianness handling of led_mode (Simon Horman)
- drm/mipi-dbi: Fix blanking for non-16 bit formats (Russell Cloran)
- drm/tests: shmem: Fix memleak (Maxime Ripard)
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Takashi Iwai) [Orabug: 37970918] {CVE-2025-37891}
- scsi: ufs: core: Remove redundant query_complete trace (Keoseong Park)
- idpf: fix offloads support for encapsulated packets (Madhu Chittim)
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Luoxuanqiang) [Orabug: 37976779] {CVE-2025-37912}
- net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976783] {CVE-2025-37913}
- net_sched: ets: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976788] {CVE-2025-37914}
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira) [Orabug: 37970915] {CVE-2025-37890}
- net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira) [Orabug: 37976792] {CVE-2025-37915}
- pds_core: remove write-after-free of client_id (Shannon Nelson) [Orabug: 37976797] {CVE-2025-37916}
- pds_core: specify auxiliary_device to be created (Shannon Nelson)
- pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson)
- net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array (Daniel Golle)
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised (Louis-Alexis Eyraud)
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (Louis-Alexis Eyraud) [Orabug: 37976802] {CVE-2025-37917}
- rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation (Justin Lai)
- bnxt_en: improve TX timestamping FIFO configuration (Vadim Fedorenko)
- octeon_ep_vf: Resolve netdevice usage count issue (Sathesh Edara)
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID (Vladimir Oltean)
- Bluetooth: L2CAP: copy RX timestamp to new fragments (Pauli Virtanen)
- Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths (Kiran K)
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (En-Wei Wu) [Orabug: 37976804] {CVE-2025-37918}
- Bluetooth: btintel_pcie: Avoid redundant buffer allocation (Kiran K)
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Remove alloc from critical section (Iulia Tanasescu)
- ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot (Venkata Prasad Potturu) [Orabug: 37976806] {CVE-2025-37919}
- accel/ivpu: Correct DCT interrupt handling (Karol Wachowski)
- net/mlx5: E-switch, Fix error handling for enabling roce (Chris Mi)
- net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover (Cosmin Ratiu)
- net/mlx5e: TC, Continue the attr process even if encap entry is invalid (Jianbo Liu)
- net/mlx5: E-Switch, Initialize MAC Address for Default GID (Maor Gottlieb)
- net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru)
- xsk: Fix race condition in AF_XDP generic RX path (Eryk Kubanski) [Orabug: 37976809] {CVE-2025-37920}
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry (Ido Schimmel) [Orabug: 37976815] {CVE-2025-37921}
- powerpc/boot: Fix dash warning (Madhavan Srinivasan)
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release (Murad Masimov) [Orabug: 37976734] {CVE-2025-37897}
- wifi: iwlwifi: fix the check for the SCRATCH register upon resume (Emmanuel Grumbach)
- wifi: iwlwifi: don't warn if the NIC is gone in resume (Emmanuel Grumbach)
- drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions' (Chen Linxuan)
- ALSA: hda/realtek - Enable speaker for HP platform (Kailang Yang)
- ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init() (Chenyuan Yang)
- powerpc/boot: Check for ld-option support (Madhavan Srinivasan)
- pinctrl: imx: Return NULL if no group is matched and found (Hui Wang)
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Donet Tom) [Orabug: 37976819] {CVE-2025-37922}
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence (Sheetal)
- ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB (Richard Fitzgerald)
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties (Geert Uytterhoeven)
- drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF (Sun Peng Li)
- tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park) [Orabug: 37976821] {CVE-2025-37923}
- cpufreq: Fix setting policy limits when frequency tables are used (Rafael J. Wysocki)
- cpufreq: Avoid using inconsistent policy-&gt;min and policy-&gt;max (Rafael J. Wysocki)
- smb: client: fix zero length for mkdir POSIX create context (Jethro Donaldson)
- ksmbd: fix use-after-free in session logoff (Sean Heelan) [Orabug: 37976738] {CVE-2025-37899}
- ksmbd: fix use-after-free in kerberos authentication (Sean Heelan) [Orabug: 37976828] {CVE-2025-37924}
- ksmbd: fix use-after-free in ksmbd_session_rpc_open (Namjae Jeon) [Orabug: 37976832] {CVE-2025-37926}
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug (Shouye Liu)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles (Mario Limonciello)
- iommu: Fix two issues in iommu_copy_struct_from_user() (Nicolin Chen) [Orabug: 37976741] {CVE-2025-37900}
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) (Mingcong Bai)
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains (Balbir Singh)
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids (Nicolin Chen)
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov) [Orabug: 37976836] {CVE-2025-37927}
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS (Janne Grunau)
- drm/amdgpu: Fix offset for HDP remap in nbio v7.11 (Lijo Lazar)
- dm: always update the array size in realloc_argv on success (Benjamin Marzinski)
- dm-integrity: fix a warning on invalid table line (Mikulas Patocka)
- dm-bufio: don't schedule in atomic context (Longping Wei) [Orabug: 37976844] {CVE-2025-37928}
- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (Ard Biesheuvel)
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Xu Wang) [Orabug: 37977118] {CVE-2025-37990}
- tracing: Do not take trace_event_sem in print_event_fields() (Steven Rostedt)
- spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe (Ruslan Piasetskyi)
- mm/memblock: repeat setting reserved region nid if array is doubled (Wei Yang)
- mm/memblock: pass size instead of end to memblock_set_node() (Wei Yang)
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs (Stephan Gerhold) [Orabug: 37976744] {CVE-2025-37901}
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload (Vishal Badole)
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (Sean Christopherson) [Orabug: 37976874] {CVE-2025-37936}
- perf/x86/intel: Only check the group flag for X86 leader (Kan Liang)
- parisc: Fix double SIGFPE crash (Helge Deller) [Orabug: 37977127] {CVE-2025-37991}
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Will Deacon) [Orabug: 37977182] {CVE-2025-37929}
- i2c: imx-lpi2c: Fix clock count when probe defers (Clark Wang)
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration (Niravkumar L Rabara)
- EDAC/altera: Test the correct error reg offset (Niravkumar L Rabara)
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (Philipp Stanner) [Orabug: 37976850] {CVE-2025-37930}
- drm/fdinfo: Protect against driver unbind (Tvrtko Ursulin)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (Srinivas Pandruvada)
- btrfs: fix COW handling in run_delalloc_nocow() (Dave Chen)
- btrfs: adjust subpage bit start based on sectorsize (Josef Bacik) [Orabug: 37976853] {CVE-2025-37931}
- binder: fix offset calculation in debug log (Carlos Llamas)
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset (Joachim Priesner)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() (Geoffrey D. Bennett)
- Revert "rndis_host: Flag RNDIS modems as WWAN devices" (Christian Heusel)
- Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID for WCN785x (Dorian Cruveiller)
- Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x (Mark Dietzer)
- Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (Zijun Hu)
- Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x (Aaron Ma)
- x86/PCI: Export find_cap() to be used in early PCI code (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Scan all busses for early PCI quirks (Rayan Dasoriya) [Orabug: 37383447]
- x86/quirks: Add parameter to clear MSIs early on boot (Rayan Dasoriya) [Orabug: 37383447]
- scsi: megaraid_sas: Driver version update to 07.734.00.00-rc1 (Chandrakanth Patil) [Orabug: 37877985]
- scsi: megaraid_sas: Make most module parameters static (Dr. David Alan Gilbert) [Orabug: 37877985]
- scsi: mpt3sas: Fix buffer overflow in mpt3sas_send_mctp_passthru_req() (Dan Carpenter) [Orabug: 37878012]
- scsi: mpt3sas: Fix spelling mistake "receveid" -&gt; "received" (Colin Ian King) [Orabug: 37878012]
- scsi: mpt3sas: update driver version to 52.100.00.00 (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Send a diag reset if target reset fails (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Report driver capability as part of IOCINFO command (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Add support for MCTP Passthrough commands (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Update MPI headers to 02.00.62 version (Shivasharan S) [Orabug: 37878012]
- scsi: mpt3sas: Fix a locking bug in an error path (Bart Van Assche) [Orabug: 37878012]
- scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Remove unused config functions (Dr. David Alan Gilbert) [Orabug: 37878012]
- scsi: mpt3sas: Add details to EEDPTagMode error message (Paul Menzel) [Orabug: 37878012]
- scsi: mpt3sas: Update driver version to 51.100.00.00 (Ranjan Kumar) [Orabug: 37878012]
- vhost-scsi: log event queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log control queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: log I/O queue write descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost-scsi: adjust vhost_scsi_get_desc() to log vring descriptors (Dongli Zhang) [Orabug: 37883837]
- vhost: modify vhost_log_write() for broader users (Dongli Zhang) [Orabug: 37883837]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 37899161]
- uek-rpm: Move vmxnet3 to module-core in UEK8 (Harshit Mogalapalli) [Orabug: 37908279]
- x86/bugs: Enabling Retbleed and SRSO mitigation can taint the kernel (Alexandre Chartre) [Orabug: 37936569]
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta) [Orabug: 37920673]
- x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon) [Orabug: 37920673]
- x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon) [Orabug: 37920673]
- selftest/x86/bugs: Add selftests for ITS (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add "vmexit" option to skip mitigation on some CPUs (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Pawan Gupta) [Orabug: 37945459] {CVE-2024-28956}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.1.el10uek]" date="1747483200">- KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (Michael Roth) [Orabug: 37894105]
- KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching (Michael Roth) [Orabug: 37894105]
- Revert "KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching" (Liam Merwick) [Orabug: 37894105]
- uek-rpm: Enable SECURITY_DMESG_RESTRICT in UEK8 (Harshit Mogalapalli) [Orabug: 37867042]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-100.28.2.el10uek]" date="1747656000">- sched/eevdf: Fix se-&gt;slice being set to U64_MAX and resulting crash (Omar Sandoval) [Orabug: 37930100] {CVE-2025-37821}
- certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang) [Orabug: 37967533]
- Revert "block: sysfs option to change ioticks granularity" (Gulam Mohamed) [Orabug: 37921776]
- RDS: use pin_user_pages_fast() (Stephen Brennan) [Orabug: 37968545]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.31.1.el10uek]" date="1748952000">- LTS version: v6.12.31 (Jack Vogel)
- drm/gem: Internally test import_attach for imported objects (Thomas Zimmermann)
- x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers (Balbir Singh)
- i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() (Nathan Chancellor)
- pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group() (Dan Carpenter)
- watchdog: aspeed: fix 64-bit division (Arnd Bergmann)
- drm/amdkfd: Correct F8_MODE for gfx950 (Amber Lin)
- serial: sh-sci: Save and restore more registers (Geert Uytterhoeven)
- bpf: abort verification if env-&gt;cur_state-&gt;loop_entry != NULL (Eduard Zingerman)
- drm/amd/display: Exit idle optimizations before accessing PHY (Ovidiu Bunea)
- kbuild: Properly disable -Wunterminated-string-initialization for clang (Nathan Chancellor)
- Fix mis-uses of 'cc-option' for warning disablement (Linus Torvalds)
- gcc-15: disable '-Wunterminated-string-initialization' entirely for now (Linus Torvalds)
- gcc-15: make 'unterminated string initialization' just a warning (Linus Torvalds)
- err.h: move IOMEM_ERR_PTR() to err.h (Raag Jadav)
- spi: spi-fsl-dspi: Reset SR flags before sending a new message (Larisa Grigore)
- spi: spi-fsl-dspi: Halt the module after a new message transfer (Bogdan-Gabriel Roman)
- spi: spi-fsl-dspi: restrict register range for regmap access (Larisa Grigore)
- spi: use container_of_cont() for to_spi_device() (Greg Kroah-Hartman)
- platform/x86: think-lmi: Fix attribute name usage for non-compliant items (Mark Pearson)
- ksmbd: fix stream write failure (Namjae Jeon)
- Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection" (Jernej Skrabec)
- Bluetooth: btmtksdio: Do close if SDIO card removed without close (Chris Lu)
- Bluetooth: btmtksdio: Check function enabled before doing close (Chris Lu)
- nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() (Ryusuke Konishi)
- mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled (Ignacio Moreno Gonzalez)
- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Tianyang Zhang)
- memcg: always call cond_resched() after fn() (Breno Leitao)
- highmem: add folio_test_partial_kmap() (Matthew Wilcox)
- Input: xpad - add more controllers (Vicki Pfau)
- Revert "drm/amd: Keep display off while going into S4" (Mario Limonciello)
- smb: client: Reset all search buffer pointers when releasing buffer (Zhaolong Wang)
- arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (Gabor Juhos)
- smb: client: Fix use-after-free in cifs_fill_dirent (Zhaolong Wang) [Orabug: 38094970] {CVE-2025-38051}
- drm/edid: fixed the bug that hdr metadata was not reset (Feijuan Li)
- thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature (Zhang Rui)
- platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin) [Orabug: 38095141] {CVE-2025-38077}
- pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
- pmdomain: renesas: rcar: Remove obsolete nullify checks (Geert Uytterhoeven)
- vmxnet3: update MTU after device quiesce (Ronak Doshi)
- net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
- can: kvaser_pciefd: Fix echo_skb race (Axel Forsman)
- can: kvaser_pciefd: Continue parsing DMA buf after dropped RX (Axel Forsman)
- llc: fix data loss when reading from a socket in llc_ui_recvmsg() (Gavrilov Ilia)
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10 (Ed Burcher)
- ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [Orabug: 38095145] {CVE-2025-38078}
- ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction (Peter Ujfalusi)
- ASoc: SOF: topology: connect DAI to a single DAI link (Kai Vehmanen)
- ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext (Peter Ujfalusi)
- can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp) [Orabug: 38049369] {CVE-2025-38003}
- can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 38049374] {CVE-2025-38004}
- can: slcan: allow reception of short error messages (Carlos Sanchez)
- padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094842] {CVE-2025-38031}
- crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [Orabug: 38095153] {CVE-2025-38079}
- clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe() (André Draszik)
- octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG (Geetha Sowjanya)
- octeontx2-af: Set LMT_ENA bit for APR table entries (Subbaraya Sundeep)
- net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang) [Orabug: 38094978] {CVE-2025-38052}
- octeontx2-pf: Add AF_XDP non-zero copy support (Suman Ghosh)
- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [Orabug: 38049357] {CVE-2025-38000}
- idpf: fix idpf_vport_splitq_napi_poll() (Eric Dumazet)
- io_uring: fix overflow resched cqe reordering (Pavel Begunkov)
- net: lan743x: Restore SGMII CTRL register on resume (Thangaraj Samynathan)
- net: dwmac-sun8i: Use parsed internal PHY address instead of 1 (Paul Kocialkowski)
- pinctrl: qcom: switch to devm_register_sys_off_handler() (Dmitry Baryshkov)
- loop: don't require -&gt;write_iter for writable files in loop_configure (Christoph Hellwig)
- idpf: fix null-ptr-deref in idpf_features_check (Pavan Kumar Linga) [Orabug: 38094982] {CVE-2025-38053}
- ice: Fix LACP bonds without SRIOV environment (Dave Ertman)
- ice: fix vf-&gt;num_mac count with port representors (Jacob Keller)
- bridge: netfilter: Fix forwarding of fragmented packets (Ido Schimmel)
- ptp: ocp: Limit signal/freq counts in summary output functions (Sagi Maimon) [Orabug: 38094984] {CVE-2025-38054}
- Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling (En-Wei Wu)
- Bluetooth: L2CAP: Fix not checking l2cap_chan security level (Luiz Augusto von Dentz)
- perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter) [Orabug: 38094988] {CVE-2025-38055}
- irqchip/riscv-imsic: Start local sync timer on correct CPU (Andrew Bresticker)
- ASoC: SOF: Intel: hda: Fix UAF when reloading module (Tavian Barnes) [Orabug: 38094991] {CVE-2025-38056}
- devres: Introduce devm_kmemdup_array() (Raag Jadav)
- driver core: Split devres APIs to device/devres.h (Andy Shevchenko)
- dmaengine: fsl-edma: Fix return code for unhandled interrupts (Stefan Wahren)
- dmaengine: idxd: Fix -&gt;poll() return value (Dave Jiang)
- xfrm: Sanitize marks before insert (Paul Chaignon)
- clk: sunxi-ng: d1: Add missing divider for MMC mod clocks (Andre Przywara)
- remoteproc: qcom_wcnss: Fix on platforms without fallback regulators (Matti Lehtimäki)
- kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() (David Hildenbrand)
- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (Seongman Lee)
- dmaengine: idxd: Fix allowing write() from different address spaces (Vinicius Costa Gomes)
- xfrm: Fix UDP GRO handling for some corner cases (Tobias Brunner)
- espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca)
- espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094993] {CVE-2025-38057}
- soundwire: bus: Fix race on the creation of the IRQ domain (Charles Keepax)
- __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [Orabug: 38095000] {CVE-2025-38058}
- drm/amd/display: Call FP Protect Before Mode Programming/Mode Support (Austin Zheng)
- xenbus: Allow PVH dom0 a non-local xenstore (Jason Andryuk)
- x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust &gt;= 1.88 (Paweł Anikiel) [Orabug: 38094847] {CVE-2025-38033}
- wifi: iwlwifi: add support for Killer on MTL (Johannes Berg)
- block: only update request sector if needed (Johannes Thumshirn)
- tools: ynl-gen: validate 0 len strings from kernel (David Wei)
- btrfs: avoid NULL pointer dereference if no valid csum tree (Qu Wenruo) [Orabug: 38095010] {CVE-2025-38059}
- btrfs: handle empty eb-&gt;folios in num_extent_folios() (Boris Burkov)
- btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [Orabug: 38094856] {CVE-2025-38034}
- btrfs: compression: adjust cb-&gt;compressed_folios allocation type (Kees Cook)
- ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers (Stefan Binding)
- cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function (Pali Rohár)
- cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info() (Pali Rohár)
- io_uring/fdinfo: annotate racy sq/cq head/tail reads (Jens Axboe)
- nvmet-tcp: don't restore null sk_state_change (Alistair Francis) [Orabug: 38094863] {CVE-2025-38035}
- ALSA: usb-audio: Fix duplicated name in MIDI substream names (Takashi Iwai)
- nvme-pci: add quirks for WDC Blue SN550 15b7:5009 (Guan Wentao)
- nvme-pci: add quirks for device 126f:1001 (Guan Wentao)
- ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 (Takashi Iwai)
- ASoC: cs42l43: Disable headphone clamps during type detection (Charles Keepax)
- platform/x86: ideapad-laptop: add support for some new buttons (Gašper Nemgar)
- platform/x86: asus-wmi: Disable OOBE state after resume from hibernation (Pavel Nikulin)
- platform/x86/intel: hid: Add Pantherlake support (Saranya Gopal)
- smb: server: smb2pdu: check return value of xa_store() (Salah Triki)
- pinctrl: meson: define the pull up/down resistor value as 60 kOhm (Martin Blumenstingl)
- book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n (Ritesh Harjani)
- ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of() (Chenyuan Yang)
- drm: Add valid clones check (Jessica Zhang)
- drm/panel-edp: Add Starry 116KHD024006 (Douglas Anderson)
- drm/buddy: fix issue that force_merge cannot free all roots (Lin Cao)
- drm/atomic: clarify the rules around drm_atomic_state-&gt;allow_modeset (Simona Vetter)
- drm/xe: Reject BO eviction if BO is bound to current VM (Oak Zeng)
- drm/xe/sa: Always call drm_suballoc_manager_fini() (Michal Wajdeczko)
- wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event (Ching-Te Ku)
- drm/xe: Do not attempt to bootstrap VF in execlists mode (Maarten Lankhorst)
- drm/xe: Move suballocator init to after display init (Maarten Lankhorst)
- wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (P Praneesh)
- drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE (Zhi Wang)
- drm: bridge: adv7511: fill stream capabilities (Olivier Moysan)
- wifi: ath12k: Fix end offset bit definition in monitor ring descriptor (P Praneesh)
- wifi: ath12k: Fetch regdb.bin file from board-2.bin (Aaradhana Sahu)
- wifi: ath9k: return by of_get_mac_address (Rosen Penev)
- drm/xe/pf: Reset GuC VF config when unprovisioning critical resource (Michal Wajdeczko)
- accel/qaic: Mask out SR-IOV PCI resources (Youssef Samir)
- wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override (Nicolas Escande)
- regulator: ad5398: Add device tree support (Isaac Scott)
- spi: zynqmp-gqspi: Always acknowledge interrupts (Sean Anderson)
- wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet (Ping-Ke Shih)
- wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate (Bitterblue Smith)
- wifi: rtl8xxxu: retry firmware download on error (Soeren Moch)
- clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation (Lad Prabhakar)
- perf/amd/ibs: Fix -&gt;config to sample period calculation for OP PMU (Ravi Bangoria)
- perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (Ravi Bangoria)
- firmware: arm_scmi: Relax duplicate name constraint across protocol ids (Sudeep Holla)
- bpftool: Fix readlink usage in get_fd_type (Viktor Malik)
- bpf: Use kallsyms to find the function name of a struct_ops's stub function (Martin Kafai Lau)
- drm/ast: Find VBIOS mode from regular display size (Thomas Zimmermann)
- dm vdo: use a short static string for thread name prefix (Matthew Sakai)
- dm vdo indexer: prevent unterminated string warning (Chung Chung)
- irqchip/riscv-aplic: Add support for hart indexes (Vladimir Kondratiev)
- ASoC: rt722-sdca: Add some missing readable registers (Charles Keepax)
- ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode (Cezary Rojewski)
- arm64: zynqmp: add clock-output-names property in clock nodes (Naman Trivedi Manojbhai)
- HID: usbkbd: Fix the bit shift number for LED_KANA (Junan)
- wifi: ath12k: Avoid napi_sync() before napi_enable() (Avula Sri Charan)
- scsi: st: Restore some drive settings after reset (Kai Mäkisara)
- net/mana: fix warning in the writer of client oob (Konstantin Taranov)
- drm/xe/relay: Don't use GFP_KERNEL for new transactions (Michal Wajdeczko)
- ice: count combined queues using Rx/Tx count (Michal Swiatkowski)
- perf: Avoid the read if the count is already updated (Peter Zijlstra)
- rcu: fix header guard for rcu_all_qs() (Ankur Arora)
- rcu: handle unstable rdp in rcu_read_unlock_strict() (Ankur Arora)
- rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y (Ankur Arora)
- ice: treat dyn_allowed only as suggestion (Michal Swiatkowski)
- ice: init flow director before RDMA (Michal Swiatkowski)
- bridge: mdb: Allow replace of a host-joined group (Petr Machata)
- net: flush_backlog() small changes (Eric Dumazet)
- r8169: don't scan PHY addresses &gt; 0 (Heiner Kallweit)
- ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only (Geert Uytterhoeven)
- vxlan: Annotate FDB data races (Ido Schimmel) [Orabug: 38094879] {CVE-2025-38037}
- cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (Dhananjay Ugwekar) [Orabug: 38094888] {CVE-2025-38038}
- tools: ynl-gen: don't output external constants (Jakub Kicinski)
- eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs (Alexander Duyck)
- drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0 (Cristian Ciocaltea)
- media: qcom: camss: Add default case in vfe_src_pad_code (Depeng Shao)
- media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available (Depeng Shao)
- f2fs: introduce f2fs_base_attr for global sysfs entries (Jaegeuk Kim)
- hwmon: (xgene-hwmon) use appropriate type for the latency value (Andrey Vatoropin)
- tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options (Len Brown)
- net: page_pool: avoid false positive warning if NAPI was never added (Jakub Kicinski)
- clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs (Jordan Crouse)
- wifi: rtw89: call power_on ahead before selecting firmware (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before accessing (Ping-Ke Shih)
- wifi: rtw89: fw: validate multi-firmware header before getting its size (Ping-Ke Shih)
- wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang (Ching-Te Ku)
- wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix download_firmware_validate() for RTL8814AU (Bitterblue Smith)
- ext4: remove writable userspace mappings before truncating page cache (Zhang Yi)
- ext4: don't write back data before punch hole in nojournal mode (Zhang Yi)
- leds: trigger: netdev: Configure LED blink interval for HW offload (Marek Vasut)
- pstore: Change kmsg_bytes storage size to u32 (Kees Cook)
- iio: adc: ad7944: don't use storagebits for sizing (David Lechner)
- r8152: add vendor/device ID pair for Dell Alienware AW1022z (Aleksander Jan Bajkowski)
- ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). (Kuniyuki Iwashima)
- arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src (Athira Rajeev)
- powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (Gaurav Batra)
- powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Gaurav Batra)
- net: fec: Refactor MAC reset to function (Csókás Bence)
- wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx (Emmanuel Grumbach)
- wifi: mac80211: remove misplaced drv_mgd_complete_tx() call (Johannes Berg)
- wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() (Johannes Berg)
- wifi: iwlwifi: don't warn during reprobe (Miri Korenblit)
- wifi: iwlwifi: use correct IMR dump variable (Johannes Berg)
- mptcp: pm: userspace: flags: clearer msg if no remote addr (Matthieu Baerts)
- wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV (P Praneesh)
- xfrm: prevent high SEQ input in non-ESN mode (Leon Romanovsky)
- drm/v3d: Add clock handling (Stefan Wahren)
- net/mlx5e: reduce the max log mpwrq sz for ECPF and reps (William Tu)
- net/mlx5e: reduce rep rxq depth to 256 for ECPF (William Tu)
- net/mlx5e: set the tx_queue_len for pfifo_fast (William Tu)
- net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB (Alexei Lazar)
- net/mlx5: XDP, Enable TX side XDP multi-buffer support (Alexei Lazar)
- scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr() (Chaohai Chen)
- drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer() (Alex Deucher)
- drm/amdgpu: enlarge the VBIOS binary size limit (Morris Zhang)
- drm/amdgpu: Use active umc info from discovery (Lijo Lazar)
- drm/amd/display: Populate register address for dentist for dcn401 (Dillon Varone)
- drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It (Austin Zheng)
- drm/amd/display: Increase block_sequence array size (Joshua Aberback) [Orabug: 38095164] {CVE-2025-38080}
- drm/amd/display: Initial psr_version with correct setting (Tom Chung)
- drm/amd/display: Update CR AUX RD interval interpretation (George Shen)
- Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY" (Brandon Syu)
- drm/amd/display: Support multiple options during psr entry. (Martin Tsai)
- drm/amd/pm: Skip P2S load for SMU v13.0.12 (Asad Kamal)
- drm/amdgpu: reset psp-&gt;cmd to NULL after releasing the buffer (Jiang Liu)
- drm/amd/display: Don't try AUX transactions on disconnected link (Ilya Bakoulin)
- drm/amd/display: pass calculated dram_speed_mts to dml2 (Charlene Liu)
- drm/amdgpu: Set snoop bit for SDMA for MI series (Harish Kasiviswanathan)
- drm/amdkfd: fix missing L2 cache info in topology (Eric Huang)
- drm/amdgpu/mes11: fix set_hw_resources_1 calculation (Alex Deucher)
- net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size (Huacai Chen)
- soundwire: cadence_master: set frame shape and divider based on actual clk freq (Bard Liao)
- soundwire: amd: change the soundwire wake enable/disable sequence (Vijendar Mukunda)
- phy: exynos5-usbdrd: fix EDS distribution tuning (gs101) (André Draszik)
- phy: core: don't require set_mode() callback for phy_get_mode() to work (Dmitry Baryshkov)
- phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF (Damon Ding)
- pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down (Claudiu Beznea)
- serial: sh-sci: Update the suspend/resume support (Claudiu Beznea)
- sched: Reduce the default slice to avoid tasks getting an extra tick (Zihan Zhou)
- x86/traps: Cleanup and robustify decode_bug() (Peter Zijlstra)
- x86/ibt: Handle FineIBT in handle_cfi_failure() (Peter Zijlstra)
- drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set (Shuicheng Lin)
- drm/xe/debugfs: fixed the return value of wedged_mode_set (Xin Wang)
- clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate (Krzysztof Kozlowski)
- clk: qcom: ipq5018: allow it to be bulid on arm32 (Karl Chan)
- drm/xe: Fix xe_tile_init_noalloc() error propagation (Lucas De Marchi)
- drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init() (Lucas De Marchi)
- net/mlx4_core: Avoid impossible mlx4_db_alloc() order value (Kees Cook)
- media: v4l: Memset argument to 0 before calling get_mbus_config pad op (Sakari Ailus)
- media: i2c: imx219: Correct the minimum vblanking value (David Plowman)
- kunit: tool: Use qboot on QEMU x86_64 (Brendan Jackman)
- smack: Revert "smackfs: Added check catlen" (Konstantin Andreev)
- smack: recognize ipv4 CIPSO w/o categories (Konstantin Andreev)
- pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map (Valentin Caron)
- ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() (Kuninori Morimoto)
- ASoC: tas2764: Power up/down amp on mute ops (Hector Martin)
- ASoC: tas2764: Mark SW_RESET as volatile (Hector Martin)
- ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG (Hector Martin)
- ASoC: ops: Enforce platform maximum on initial value (Martin Povišer)
- firmware: xilinx: Dont send linux address to get fpga config get status (Siva Durga Prasad Paladugu)
- firmware: arm_ffa: Handle the presence of host partition in the partition info (Sudeep Holla)
- firmware: arm_ffa: Reject higher major version as incompatible (Sudeep Holla)
- net/mlx5: Apply rate-limiting to high temperature warning (Shahar Shitrit)
- net/mlx5: Modify LSB bitmask in temperature event to include only the first bit (Shahar Shitrit)
- media: test-drivers: vivid: don't call schedule in loop (Hans Verkuil)
- irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base (Andrew Jones)
- hrtimers: Replace hrtimer_clock_to_base_table with switch-case (Andy Shevchenko)
- vxlan: Join / leave MC group after remote changes (Petr Machata)
- ACPI: HED: Always initialize before evged (Xiaofei Tan)
- PCI: Fix old_size lower bound in calculate_iosize() too (Ilpo Järvinen)
- eth: mlx4: don't try to complete XDP frames in netpoll (Jakub Kicinski)
- bpf: copy_verifier_state() should copy 'loop_entry' field (Eduard Zingerman) [Orabug: 38095018] {CVE-2025-38060}
- bpf: don't do clean_live_states when state-&gt;loop_entry-&gt;branches &gt; 0 (Eduard Zingerman)
- can: c_can: Use of_property_present() to test existence of DT property (Krzysztof Kozlowski)
- pmdomain: imx: gpcv2: use proper helper for property detection (Ahmad Fatoum)
- RDMA/core: Fix best page size finding when it can cross SG entries (Michael Margolin)
- serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (Alexis Lothoré) [Orabug: 38094901] {CVE-2025-38040}
- drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink (Harry Wentland)
- Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP" (Leo Zeng)
- drm/amd/display: Read LTTPR ALPM caps during link cap retrieval (George Shen)
- drm/amd/display: Fix BT2020 YCbCr limited/full range input (Ilya Bakoulin)
- drm/amd/display: Guard against setting dispclk low when active (Nicholas Kazlauskas)
- drm/amd/display: Add support for disconnected eDP streams (Harry Vanzylldejong)
- drm/amd/pm: Fetch current power limit from PMFW (Lijo Lazar)
- irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector (Anup Patel)
- eeprom: ee1004: Check chip before probing (Eddie James)
- mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs (Chris Morgan)
- i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA) (Frank Li)
- EDAC/ie31200: work around false positive build warning (Arnd Bergmann)
- power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree (Chris Morgan)
- net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [Orabug: 38095024] {CVE-2025-38061}
- wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU (Kuan-Chung Chen)
- wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware (Ping-Ke Shih)
- wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32() (Ping-Ke Shih)
- wifi: rtw89: fw: propagate error code from rtw89_h2c_tx() (Ping-Ke Shih)
- wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU (Bitterblue Smith)
- wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU (Bitterblue Smith)
- PCI: epf-mhi: Update device ID for SA8775P (Mrinmay Sarkar)
- clocksource: mips-gic-timer: Enable counter when CPUs start (Paul Burton)
- MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core (Paul Burton)
- genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (Jason Gunthorpe) [Orabug: 38095031] {CVE-2025-38062}
- x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op() (Uros Bizjak)
- drm/amdgpu: remove all KFD fences from the BO on release (Christian König)
- MIPS: Use arch specific syscall name match function (Bibo Mao)
- drm/xe/oa: Ensure that polled read returns latest data (Umesh Nerlige Ramappa)
- net: ipv6: Init tunnel link-netns before registering dev (Xiao Liang)
- crypto: skcipher - Zap type in crypto_alloc_sync_skcipher (Herbert Xu)
- crypto: ahash - Set default reqsize from ahash_alg (Herbert Xu)
- x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh)
- net/mlx5: Change POOL_NEXT_SIZE define value and make it global (Patrisious Haddad)
- scsi: scsi_debug: First fixes for tapes (Kai Mäkisara)
- dm: fix unconditional IO throttle caused by REQ_PREFLUSH (Jinliang Zheng) [Orabug: 38095038] {CVE-2025-38063}
- libbpf: Fix out-of-bound read (Nandakumar Edamana)
- loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize (Christoph Hellwig)
- net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode (Jianbo Liu)
- media: tc358746: improve calculation of the D-PHY timing registers (Matthias Fend)
- media: adv7180: Disable test-pattern control on adv7180 (Niklas Söderlund)
- cpuidle: menu: Avoid discarding useful information (Rafael J. Wysocki)
- vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines (Konstantin Shkolnyy)
- x86/nmi: Add an emergency handler in nmi_desc &amp; use it in nmi_shootdown_cpus() (Waiman Long)
- ASoC: mediatek: mt8188: Add reference for dmic clocks (Nícolas F R A Prado)
- ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile (Nícolas F R A Prado)
- drm/amd/display: Fix mismatch type comparison (Navid Assadian)
- drm/amd/display: fix dcn4x init failed (Charlene Liu)
- drm/amd/display: handle max_downscale_src_width fail check (Yihan Zhu)
- x86/build: Fix broken copy command in genimage.sh when making isoimage (Nir Lichtman)
- Octeontx2-af: RPM: Register driver with PCI subsys IDs (Hariprasad Kelam)
- bpf: Search and add kfuncs in struct_ops prologue and epilogue (Amery Hung)
- soc: ti: k3-socinfo: Do not use syscon helper to build regmap (Andrew Davis)
- wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band (Ramasamy Kaliappan)
- bonding: report duplicate MAC address in all situations (Hangbin Liu)
- net: xgene-v2: remove incorrect ACPI_PTR annotation (Arnd Bergmann)
- net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only (Eric Woudstra)
- leds: pwm-multicolor: Add check for fwnode_property_read_u32 (Yuanjun Gong)
- drm/xe: xe_gen_wa_oob: replace program_invocation_short_name (Daniel Gomez)
- drm/amdkfd: KFD release_work possible circular locking (Philip Yang)
- pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf (Inochi Amaoto)
- selftests/net: have `gro.sh -t` return a correct exit code (Kevin Krakauer)
- net/mlx5: Avoid report two health errors on same syndrome (Moshe Shemesh)
- drm/xe/pf: Create a link between PF and VF devices (K V P Satyanarayana)
- drm/xe/vf: Retry sending MMIO request to GUC on timeout error (K V P Satyanarayana)
- firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar) [Orabug: 38094925] {CVE-2025-38043}
- PCI: brcmstb: Add a softdep to MIP MSI-X driver (Stanimir Varbanov)
- PCI: brcmstb: Expand inbound window size up to 64GB (Stanimir Varbanov)
- wifi: ath12k: Report proper tx completion status to mac80211 (Vinith Kumar R)
- soc: apple: rtkit: Implement OSLog buffers properly (Hector Martin)
- soc: apple: rtkit: Use high prio work queue (Janne Grunau)
- perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters (Rob Herring)
- fpga: altera-cvp: Increase credit timeout (Kuhanh Murugasen Krishnan)
- drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence (AngeloGioacchino Del Regno)
- ARM: at91: pm: fix at91_suspend_finish for ZQ calibration (Li Bin)
- hwmon: (gpio-fan) Add missing mutex locks (Alexander Stein)
- x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Breno Leitao)
- clk: imx8mp: inform CCF of maximum frequency of clocks (Ahmad Fatoum)
- media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value (Ricardo Ribalda)
- media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map (Ricardo Ribalda)
- ublk: complete command synchronously on error (Caleb Sander)
- block: mark bounce buffering as incompatible with integrity (Christoph Hellwig)
- drm/rockchip: vop2: Add uv swap for cluster window (Andy Yan)
- ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). (Kuniyuki Iwashima)
- scsi: logging: Fix scsi_logging_level bounds (Nicolas Bouchinet)
- ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7 (Maciej S. Szmigiero)
- perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (Saket Kumar Bhaskar)
- net: pktgen: fix mpls maximum labels list parsing (Peter Seiderer)
- media: imx335: Set vblank immediately (Paul Elder)
- iommufd: Disallow allocating nested parent domain with fault ID (Yi Liu)
- ublk: enforce ublks_max only for unprivileged devices (Uday Shankar)
- dpll: Add an assertion to check freq_supported_num (Jiasheng Jiang)
- net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104 (Andrei Botila)
- net: ethernet: ti: cpsw_new: populate netdev of_node (Alexander Sverdlin)
- rcu: Fix get_state_synchronize_rcu_full() GP-start detection (Paul E. McKenney)
- pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" (Artur Weber)
- media: cx231xx: set device_caps for 417 (Hans Verkuil) [Orabug: 38094934] {CVE-2025-38044}
- perf/core: Clean up perf_try_init_event() (Peter Zijlstra)
- drm/amd/display: Request HW cursor on DCN3.2 with SubVP (Aric Cyr)
- drm/amd/display: Fix p-state type when p-state is unsupported (Dillon Varone)
- drm/amd/display: Fix DMUB reset sequence for DCN401 (Dillon Varone)
- drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination (George Shen)
- drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35 (Nicholas Kazlauskas)
- drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c (Victor Lu)
- remoteproc: qcom_wcnss: Handle platforms with only single power domain (Matti Lehtimäki)
- blk-throttle: don't take carryover for prioritized processing of metadata (Ming Lei)
- net: phylink: use pl-&gt;link_interface in phylink_expects_phy() (Choong Yong Liang)
- drm/gem: Test for imported GEM buffers with helper (Thomas Zimmermann)
- orangefs: Do not truncate file size (Matthew Wilcox) [Orabug: 38095056] {CVE-2025-38065}
- soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables (AngeloGioacchino Del Regno)
- dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [Orabug: 38095063] {CVE-2025-38066}
- usb: xhci: set page size to the xHCI-supported size (Niklas Neronin)
- media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() (Markus Elfring)
- ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 (Svyatoslav Ryhel)
- soc: samsung: include linux/array_size.h where needed (Arnd Bergmann)
- drm/xe: Retry BO allocation (Matthew Brost)
- drm/xe: Nuke VM's mapping upon close (Matthew Brost)
- ieee802154: ca8210: Use proper setters and getters for bitwise types (Andy Shevchenko)
- rtc: ds1307: stop disabling alarms on probe (Alexandre Belloni)
- tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() (Eric Dumazet)
- ALSA: seq: Improve data consistency at polling (Takashi Iwai)
- powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 (Andreas Schwab)
- arm64: tegra: Resize aperture for the IGX PCIe C5 slot (Jonathan Hunter)
- arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator (Diogo Ivo)
- drm/amdgpu: Fix missing drain retry fault the last entry (Emily Deng)
- drm/amdkfd: Set per-process flags only once cik/vi (Harish Kasiviswanathan)
- drm/amdkfd: Set per-process flags only once for gfx9/10/11/12 (Harish Kasiviswanathan)
- crypto: mxs-dcp - Only set OTP_KEY bit for OTP key (Sven Schwermer)
- crypto: lzo - Fix compression buffer overrun (Herbert Xu) [Orabug: 38095079] {CVE-2025-38068}
- misc: pci_endpoint_test: Give disabled BARs a distinct error code (Niklas Cassel)
- PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops (Christian Bruel) [Orabug: 38095087] {CVE-2025-38069}
- watchdog: aspeed: Update bootstatus handling (Chin-Ting Kuo)
- cpufreq: tegra186: Share policy per cluster (Aaron Kling)
- iommu/amd/pgtbl_v2: Improve error handling (Vasant Hegde)
- coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t (Levi Yun)
- badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable &lt; 0 (Coly Li)
- ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup() (Alexey Klimov)
- auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" (Andy Shevchenko)
- gfs2: Check for empty queue in run_queue (Andreas Gruenbacher)
- drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch (Leon Huang)
- drm/amd/display: not abort link train when bw is low (Peichen Huang)
- drm/amd/display: calculate the remain segments for all pipes (Zhikai Zhai)
- drm/amd/display: remove minimum Dispclk and apply oem panel timing. (Charlene Liu)
- ipv6: save dontfrag in cork (Willem de Bruijn)
- wifi: cfg80211: allow IR in 20 MHz configurations (Anjaneyulu)
- wifi: mac80211_hwsim: Fix MLD address translation (Ilan Peer)
- wifi: mac80211: fix warning on disconnect during failed ML reconf (Johannes Berg)
- wifi: iwlwifi: fix the ECKV UEFI variable name (Emmanuel Grumbach)
- wifi: iwlwifi: mark Br device not integrated (Johannes Berg)
- wifi: iwlwifi: fix debug actions order (Johannes Berg) [Orabug: 38094942] {CVE-2025-38045}
- wifi: iwlwifi: w/a FW SMPS mode selection (Daniel Gabay)
- wifi: iwlwifi: don't warn when if there is a FW error (Miri Korenblit)
- printk: Check CON_SUSPEND when unblanking a console (Marcos Paulo de Souza)
- iommu: Keep dev-&gt;iommu state consistent (Robin Murphy)
- hwmon: (dell-smm) Increment the number of fans (Kurt Borja)
- wifi: iwlwifi: mvm: fix setting the TK when associated (Avraham Stern)
- usb: xhci: Don't change the status of stalled TDs on failed Stop EP (Michał Pecio)
- mmc: sdhci: Disable SD card clock before changing parameters (Erick Shepherd)
- mmc: dw_mmc: add exynos7870 DW MMC support (Kaustabh Chakraborty)
- arm64/mm: Check PUD_TYPE_TABLE in pud_bad() (Ryan Roberts)
- arm64/mm: Check pmd_table() in pmd_trans_huge() (Ryan Roberts)
- phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set (Andy Yan)
- PNP: Expand length of fixup id string (Kees Cook)
- netfilter: conntrack: Bound nf_conntrack sysctl writes (Nicolas Bouchinet)
- wifi: rtw89: set force HE TB mode when connecting to 11ax AP (Dian-Syuan Yang)
- timer_list: Don't use %pK through printk() (Thomas Weißschuh)
- net: hsr: Fix PRP duplicate detection (Jaakko Karrenpalo)
- net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe (Jonas Karlman)
- posix-timers: Ensure that timer initialization is fully visible (Thomas Gleixner)
- posix-timers: Add cond_resched() to posix_timer_add() search loop (Eric Dumazet)
- RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() (Maher Sanalla)
- ext4: do not convert the unwritten extents if data writeback fails (Baokun Li)
- ext4: reject the 'data_err=abort' option in nojournal mode (Baokun Li)
- clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490 (Taniya Das)
- ASoC: sun4i-codec: support hp-det-gpios property (Ryan Walklin)
- drm/amdgpu: Update SRIOV video codec caps (David Rosca)
- drm/amdgpu/gfx11: don't read registers in mqd init (Alex Deucher)
- drm/amdgpu/gfx12: don't read registers in mqd init (Alex Deucher)
- mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check (Shree Ramamoorthy)
- pinctrl-tegra: Restore SFSEL bit when freeing pins (Prathamesh Shete)
- xen: Add support for XenServer 6.1 platform device (Frediano Ziglio)
- net/smc: use the correct ndev to find pnetid by pnetid table (Guangguan Wang)
- dm: restrict dm device size to 2^63-512 bytes (Mikulas Patocka)
- crypto: octeontx2 - suppress auth failure screaming due to negative tests (Shashank Gupta)
- kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf (Masahiro Yamada)
- kbuild: fix argument parsing in scripts/config (Seyediman Seyedarab)
- bpf: Allow pre-ordering for bpf cgroup progs (Yonghong Song)
- ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect (Nícolas F R A Prado)
- ASoC: pcm6240: Drop bogus code handling IRQ as GPIO (Linus Walleij)
- spi: spi-mux: Fix coverity issue, unchecked return value (Sergio Perez Gonzalez)
- erofs: initialize decompression early (Gao Xiang)
- thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer (Mika Westerberg)
- objtool: Fix error handling inconsistencies in check() (Josh Poimboeuf)
- rtc: rv3032: fix EERD location (Alexandre Belloni)
- tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() (Ilpo Järvinen)
- jbd2: do not try to recover wiped journal (Jan Kara)
- PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off() (Frank Li)
- bpf: Return prog btf_id without capable check (Mykyta Yatsenko)
- vfio/pci: Handle INTx IRQ_NOTCONNECTED (Alex Williamson)
- scsi: st: ERASE does not change tape location (Kai Mäkisara)
- scsi: st: Tighten the page format heuristics with MODE SELECT (Kai Mäkisara)
- hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure (Al Viro)
- ext4: reorder capability check last (Christian Göttsche)
- riscv: Call secondary mmu notifier when flushing the tlb (Alexandre Ghiti)
- bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set (Shantiprasad Shettar)
- wifi: mwifiex: Fix HT40 bandwidth issue. (Jeff Chen)
- um: Update min_low_pfn to match changes in uml_reserved (Tiwei Bie)
- um: Store full CSGSFS and SS register from mcontext (Benjamin Berg)
- clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug (Nick Hu)
- dlm: make tcp still work in multi-link env (Heming Zhao)
- s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste() (Heiko Carstens)
- i3c: master: svc: Fix missing STOP for master request (Stanley Chu)
- drm/amdgpu: adjust drm_firmware_drivers_only() handling (Alex Deucher)
- drm/amd/display: Guard against setting dispclk low for dcn31x (Jing Zhou)
- drm/amdgpu: release xcp_mgr on exit (Flora Cui)
- blk-cgroup: improve policy registration error handling (Chen Linxuan)
- btrfs: send: return -ENAMETOOLONG when attempting a path that is too long (Filipe Manana)
- btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work() (Filipe Manana)
- btrfs: fix non-empty delayed iputs list on unmount due to async workers (Filipe Manana)
- btrfs: run btrfs_error_commit_super() early (Qu Wenruo)
- btrfs: avoid linker error in btrfs_find_create_tree_block() (Mark Harmstone)
- btrfs: make btrfs_discard_workfn() block_group ref explicit (Boris Burkov)
- i2c: pxa: fix call balance of i2c-&gt;clk handling routines (Vitalii Mordan)
- i2c: qup: Vote for interconnect bandwidth to DRAM (Stephan Gerhold)
- x86/mm: Check return value from memblock_phys_alloc_range() (Philip Redkin) [Orabug: 38095101] {CVE-2025-38071}
- x86/microcode: Update the Intel processor flag scan check (Sohil Mehta)
- x86/smpboot: Fix INIT delay assignment for extended Intel Families (Sohil Mehta)
- x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP (Ingo Molnar)
- x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers (Thomas Huth)
- wifi: mt76: mt7925: fix fails to enter low power mode in suspend state (Quan Zhou)
- wifi: mt76: mt7925: load the appropriate CLC data based on hardware type (Ming Yen Hsieh)
- wifi: mt76: mt7996: revise TXS size (Benjamin Lin)
- wifi: mt76: mt7996: fix SER reset trigger on WED reset (Rex Lu)
- wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 (Felix Fietkau)
- cgroup/rstat: avoid disabling irqs for O(num_cpu) (Eric Dumazet)
- drm/amdgpu: Skip pcie_replay_count sysfs creation for VF (Victor Skvortsov)
- mmc: host: Wait for Vdd to settle on card power off (Erick Shepherd)
- staging: vchiq_arm: Create keep-alive thread during probe (Stefan Wahren)
- pidfs: improve multi-threaded exec and premature thread-group leader exit polling (Christian Brauner)
- libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [Orabug: 38095109] {CVE-2025-38072}
- ext4: on a remount, only log the ro or r/w state when it has changed (Nicolas Bretz)
- xen/pci: Do not register devices with segments &gt;= 0x10000 (Roger Pau Monné)
- PCI: vmd: Disable MSI remapping bypass under Xen (Roger Pau Monné)
- drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12 (Jonathan Kim)
- drm/amdgpu/discovery: check ip_discovery fw file available (Flora Cui)
- pNFS/flexfiles: Report ENETDOWN as a connection error (Trond Myklebust)
- tools/build: Don't pass test log files to linker (Ian Rogers)
- r8169: disable RTL8126 ZRX-DC timeout (Chunhao Lin)
- PCI: dwc: ep: Ensure proper iteration over outbound map windows (Frank Li)
- objtool: Properly disable uaccess validation (Josh Poimboeuf)
- lockdep: Fix wait context check on softirq for PREEMPT_RT (Ryo Takakura)
- dql: Fix dql-&gt;limit value when reset. (Jing Su)
- Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken (Pedro Nishiyama)
- Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal (Sean Wang)
- thermal/drivers/qoriq: Power down TMU on system suspend (Alice Guo)
- thermal/drivers/mediatek/lvts: Start sensor interrupts disabled (Nícolas F R A Prado)
- net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus (Hans-Frieder Vogt)
- net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards (Hans-Frieder Vogt)
- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (Daniel Hsu)
- ASoC: codecs: wsa883x: Correct VI sense channel mask (Krzysztof Kozlowski)
- ASoC: codecs: wsa884x: Correct VI sense channel mask (Krzysztof Kozlowski)
- spi-rockchip: Fix register out of bounds access (Luis de Arquer) [Orabug: 38095173] {CVE-2025-38081}
- SUNRPC: rpcbind should never reset the port to the value '0' (Trond Myklebust)
- SUNRPC: rpc_clnt_set_transport() must not change the autobind setting (Trond Myklebust)
- NFSv4: Treat ENETUNREACH errors as fatal for state recovery (Trond Myklebust)
- cifs: Fix establishing NetBIOS session for SMB2+ connection (Pali Rohár)
- cifs: add validation check for the fields in smb_aces (Namjae Jeon)
- cifs: Set default Netbios RFC1001 server name to hostname in UNC (Pali Rohár)
- fbdev: core: tileblit: Implement missing margin clearing for tileblit (Zsolt Kajtar)
- fbcon: Use correct erase colour for clearing in fbcon (Zsolt Kajtar)
- fbdev: fsl-diu-fb: add missing device_remove_file() (Shixiong Ou)
- riscv: Allow NOMMU kernels to access all of RAM (Samuel Holland)
- mailbox: use error ret code of of_parse_phandle_with_args() (Tudor Ambarus)
- mailbox: pcc: Use acpi_os_ioremap() instead of ioremap() (Sudeep Holla)
- tpm: Convert warn to dbg in tpm2_start_auth_session() (Jonathan Mcdowell)
- ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list (Diogo Ivo)
- tracing: Mark binary printing functions with __printf() attribute (Andy Shevchenko)
- iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability (Yi Liu)
- arm64: Add support for HIP09 Spectre-BHB mitigation (Jinqian Yang)
- SUNRPC: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFS: Don't allow waiting for exiting tasks (Trond Myklebust)
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Trond Myklebust)
- io_uring/msg: initialise msg request opcode (Pavel Begunkov)
- exfat: call bh_read in get_block only when necessary (Sungjong Seo)
- fuse: Return EPERM rather than ENOSYS from link() (Matt Johnston)
- smb: client: Store original IO parameters and prevent zero IO sizes (Zhaolong Wang)
- cifs: Fix negotiate retry functionality (Pali Rohár)
- cifs: Fix querying and creating MF symlinks over SMB1 (Pali Rohár)
- cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES (Pali Rohár)
- s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log (Tony Krowiak)
- x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li) [Orabug: 38094951] {CVE-2025-38047}
- kconfig: merge_config: use an empty file as initfile (Daniel Gomez)
- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (Haoran Jiang)
- bpf: fix possible endless loop in BPF map iteration (Brandon Kammerdiener)
- io_uring: don't duplicate flushing in io_req_post_cqe (Pavel Begunkov)
- block: fix race between set_blocksize and read paths (Darrick J. Wong) [Orabug: 38095117] {CVE-2025-38073}
- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (Ihor Solodrai)
- drm/amdgpu: Allow P2P access through XGMI (Felix Kuehling)
- drm/amd/display: Enable urgent latency adjustment on DCN35 (Nicholas Susanto)
- fs/ext4: use sleeping version of sb_find_get_block() (Davidlohr Bueso)
- fs/jbd2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/ocfs2: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: use sleeping version of __find_get_block() (Davidlohr Bueso)
- fs/buffer: introduce sleeping flavors for pagecache lookups (Davidlohr Bueso)
- fs/buffer: split locking for pagecache lookups (Davidlohr Bueso)
- ima: process_measurement() needlessly takes inode_lock() on MAY_READ (Frederick Lawler)
- dma-mapping: Fix warning reported for missing prototype (Balbir Singh)
- net: enetc: refactor bulk flipping of RX buffers to separate function (Vladimir Oltean)
- vhost_task: fix vhost_task_create() documentation (Stefano Garzarella)
- cgroup: Fix compilation issue due to cgroup_mutex not being exported (Gao Xu)
- dma-mapping: avoid potential unused data compilation warning (Marek Szyprowski)
- mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type (Hans de Goede)
- intel_th: avoid using deprecated page-&gt;mapping, index fields (Lorenzo Stoakes)
- dma/mapping.c: dev_dbg support for dma_addressing_limited (Balbir Singh)
- virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han) [Orabug: 38094958] {CVE-2025-38048}
- scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices (Manish Pandey)
- scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [Orabug: 38095134] {CVE-2025-38075}
- nvmem: qfprom: switch to 4-byte aligned reads (Dmitry Baryshkov)
- nvmem: core: update raw_len if the bit reading is required (Dmitry Baryshkov)
- nvmem: core: verify cell's raw_len (Dmitry Baryshkov)
- nvmem: core: fix bit offsets of more than one byte (Dmitry Baryshkov)
- nvmem: rockchip-otp: add rk3576 variant data (Heiko Stuebner)
- nvmem: rockchip-otp: Move read-offset into variant-data (Heiko Stuebner)
- cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist (Pengyu Luo)
- phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Move IRQ request in probe (Claudiu Beznea)
- i2c: designware: Fix an error handling path in i2c_dw_pci_probe() (Christophe Jaillet)
- i2c: designware: Use temporary variable for struct device (Andy Shevchenko)
- drm/amd/display: Defer BW-optimization-blocked DRR adjustments (John Olender)
- drm/amd/display: Correct timing_adjust_pending flag setting. (Zhongwei)
- drm/amd/display: Do not enable replay when vtotal update is pending. (Sung-Huai Wang)
- drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401 (Dillon Varone)
- LTS version: v6.12.30 (Jack Vogel)
- drm/amdgpu: fix pm notifier handling (Alex Deucher)
- phy: tegra: xusb: remove a stray unlock (Dan Carpenter)
- usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977018] {CVE-2025-37967}
- drm/tiny: panel-mipi-dbi: Use drm_client_setup_with_fourcc() (Fabio Estevam)
- drm/panel-mipi-dbi: Run DRM default client setup (Thomas Zimmermann)
- drm/fbdev-dma: Support struct drm_driver.fbdev_probe (Thomas Zimmermann)
- Bluetooth: btnxpuart: Fix kernel panic during FW release (Neeraj Sanjay Kale) [Orabug: 37844459] {CVE-2025-22102}
- iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977026] {CVE-2025-37968}
- accel/ivpu: Fix fw log printing (Jacek Lawrynowicz)
- accel/ivpu: Refactor functions in ivpu_fw_log.c (Jacek Lawrynowicz)
- accel/ivpu: Reset fw log on cold boot (Tomasz Rusinowicz)
- accel/ivpu: Rename ivpu_log_level to fw_log_level (Jacek Lawrynowicz)
- mm/page_alloc: fix race condition in unaccepted memory handling (Kirill A. Shutemov) [Orabug: 38094767] {CVE-2025-38008}
- drm/xe/gsc: do not flush the GSC worker from the reset path (Daniele Ceraolo Spurio)
- CIFS: New mount option for cifs.upcall namespace resolution (Ritvik Budhiraja)
- dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (Shuai Xue) [Orabug: 38094790] {CVE-2025-38014}
- dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094793] {CVE-2025-38015}
- dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call (Shuai Xue)
- dmaengine: idxd: Add missing cleanups in cleanup internals (Shuai Xue)
- dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines (Shuai Xue)
- dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs (Shuai Xue)
- dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy (Yemike Abhilash Chandra)
- dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094756] {CVE-2025-38005}
- mm: userfaultfd: correct dirty flags set for both present and swap pte (Barry Song)
- net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
- ring-buffer: Fix persistent buffer when commit page is the reader page (Steven Rostedt)
- wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094770] {CVE-2025-38009}
- tpm: Mask TPM RC in tpm2_start_auth_session() (Jarkko Sakkinen)
- spi: tegra114: Use value to check for invalid delays (Aaron Kling)
- smb: client: fix memory leak during error handling for POSIX mkdir (Jethro Donaldson)
- scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer (Steve Siwinski)
- phy: renesas: rcar-gen3-usb2: Set timing registers only once (Claudiu Beznea)
- phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind (Claudiu Beznea)
- phy: Fix error handling in tegra_xusb_port_init (Ma Ke)
- phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking (Wayne Chang) [Orabug: 38094777] {CVE-2025-38010}
- tracing: samples: Initialize trace_array_printk() with the correct function (Steven Rostedt)
- ftrace: Fix preemption accounting for stacktrace filter command (Donglin Peng)
- ftrace: Fix preemption accounting for stacktrace trigger command (Donglin Peng)
- kbuild: Disable -Wdefault-const-init-unsafe (Nathan Chancellor)
- Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer() (Michael Kelley)
- Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (Michael Kelley)
- arm64: dts: rockchip: Remove overdrive-mode OPPs from RK3588J SoC dtsi (Dragan Simic)
- arm64: dts: amlogic: dreambox: fix missing clkc_audio node (Christian Hewitt)
- hv_netvsc: Remove rmsg_pgcnt (Michael Kelley)
- hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (Michael Kelley)
- hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (Michael Kelley)
- dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi)
- ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera (Nicolas Chauvet)
- ALSA: usb-audio: Add sample rate quirk for Audioengine D1 (Christian Heusel)
- ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() (Xu Wang)
- ACPI: PPTT: Fix processor subtable walk (Jeremy Linton)
- gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
- MAINTAINERS: Update Alexey Makhalov's email address (Alexey Makhalov)
- drm/amd/display: Avoid flooding unnecessary info messages (Wayne Lin)
- drm/amd/display: Correct the reply value when AUX write incomplete (Wayne Lin)
- drm/amdgpu: csa unmap use uninterruptible lock (Philip Yang) [Orabug: 38094779] {CVE-2025-38011}
- drm/amdgpu: fix incorrect MALL size for GFX1151 (Tim Huang)
- Revert "drm/amd/display: Hardware cursor changes color when switched to software cursor" (Melissa Wen)
- btrfs: add back warning for mount option commit values exceeding 300 (Kyoji Ogasawara)
- btrfs: fix folio leak in submit_one_async_extent() (Boris Burkov)
- btrfs: fix discard worker infinite loop after disabling discard (Filipe Manana)
- LoongArch: uprobes: Remove redundant code about resume_era (Tiezhu Yang)
- LoongArch: uprobes: Remove user_{en,dis}able_single_step() (Tiezhu Yang)
- LoongArch: Fix MAX_REG_OFFSET calculation (Huacai Chen)
- LoongArch: Save and restore CSR.CNTC for hibernation (Huacai Chen)
- LoongArch: Move __arch_cpu_idle() to .cpuidle.text section (Huacai Chen)
- LoongArch: Prevent cond_resched() occurring within kernel-fpu (Tianyang Zhang)
- HID: bpf: abort dispatch if device destroyed (Rongrong) [Orabug: 38094796] {CVE-2025-38016}
- udf: Make sure i_lenExtents is uptodate on inode eviction (Jan Kara)
- sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator (Tejun Heo) [Orabug: 38094786] {CVE-2025-38012}
- dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" (Nathan Lynch)
- NFSv4/pnfs: Reset the layout state after a layoutreturn (Trond Myklebust)
- tsnep: fix timestamping with a stacked DSA driver (Gerhard Engleder)
- net/tls: fix kernel panic when alloc_page failed (Pengtao He) [Orabug: 38094802] {CVE-2025-38018}
- mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (Ido Schimmel) [Orabug: 38094804] {CVE-2025-38019}
- wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request (Kees Cook) [Orabug: 38094788] {CVE-2025-38013}
- octeontx2-pf: Do not reallocate all ntuple filters (Subbaraya Sundeep)
- octeontx2-af: Fix CGX Receive counters (Hariprasad Kelam)
- net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability (Bc-Bocun Chen)
- octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy (Subbaraya Sundeep)
- netlink: specs: tc: all actions are indexed arrays (Jakub Kicinski)
- netlink: specs: tc: fix a couple of attribute names (Jakub Kicinski)
- drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value (Umesh Nerlige Ramappa)
- regulator: max20086: fix invalid memory access (Cosmin Tanislav) [Orabug: 38094833] {CVE-2025-38027}
- qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() (Abdun Nihaal)
- net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094808] {CVE-2025-38020}
- vsock/test: Fix occasional failure in SIOCOUTQ tests (Konstantin Shkolnyy)
- net: dsa: b53: prevent standalone from trying to forward to other ports (Jonas Gorski)
- ALSA: sh: SND_AICA should depend on SH_DMA_API (Geert Uytterhoeven)
- nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (Keith Busch)
- nvme-pci: make nvme_pci_npages_prp() __always_inline (Kees Cook)
- net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING (Vladimir Oltean)
- net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe)
- ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info (Takashi Iwai)
- ALSA: seq: Fix delivery of UMP events to group ports (Takashi Iwai)
- net: mctp: Ensure keys maintain only one ref to corresponding dev (Andrew Jeffery)
- tests/ncdevmem: Fix double-free of queue array (Cosmin Ratiu)
- selftests: ncdevmem: Switch to AF_INET6 (Stanislav Fomichev)
- selftests: ncdevmem: Make client_ip optional (Stanislav Fomichev)
- selftests: ncdevmem: Unify error handling (Stanislav Fomichev)
- selftests: ncdevmem: Separate out dmabuf provider (Stanislav Fomichev)
- selftests: ncdevmem: Redirect all non-payload output to stderr (Stanislav Fomichev)
- net: mctp: Don't access ifa_index when missing (Matt Johnston)
- mctp: no longer rely on net-&gt;dev_index_head[] (Eric Dumazet)
- tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing (Hangbin Liu)
- net_sched: Flush gso_skb list too during -&gt;change() (Cong Wang) [Orabug: 37998128] {CVE-2025-37992}
- Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags (Luiz Augusto von Dentz)
- RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Zhu Yanjun) [Orabug: 38094813] {CVE-2025-38022}
- spi: loopback-test: Do not split 1024-byte hexdumps (Geert Uytterhoeven)
- nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094818] {CVE-2025-38023}
- HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 38094764] {CVE-2025-38007}
- HID: thrustmaster: fix memory leak in thrustmaster_interrupts() (Qasim Ijaz)
- RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094827] {CVE-2025-38024}
- virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx (Koichiro Den)
- virtio_ring: add a func argument 'recycle_done' to virtqueue_reset() (Koichiro Den)
- iio: chemical: sps30: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7768-1: Fix insufficient alignment of timestamp. (Jonathan Cameron)
- xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
- xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
- Revert "drm/amd: Stop evicting resources on APUs in suspend" (Alex Deucher)
- drm/amd: Add Suspend/Hibernate notification callback support (Mario Limonciello)
- iio: pressure: mprls0025pa: use aligned_s64 for timestamp (David Lechner)
- iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
- iio: adc: ad7266: Fix potential timestamp alignment issue. (Jonathan Cameron)
- KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (Sean Christopherson)
- KVM: Add member to struct kvm_gfn_range to indicate private/shared (Isaku Yamahata)
- uio_hv_generic: Fix sysfs creation path for ring buffer (Naman Jain)
- tpm: tis: Double the timeout B to 4s (Michal Suchanek)
- tracing: probes: Fix a possible race in trace_probe_log APIs (Masami Hiramatsu)
- cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks (Waiman Long)
- arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout (Himanshu Bhavani)
- platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection (Hans de Goede)
- platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL) (Runhua He)
- binfmt_elf: Move brk for static PIE even if ASLR disabled (Kees Cook)
- riscv: dts: sophgo: fix DMA data-width configuration for CV18xx (Ze Huang)
- drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies (Mario Limonciello)
- drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC Policies (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list to always include security.* xattrs (Stephen Smalley)
- arm64: dts: rockchip: Assign RT5616 MCLK rate on rk3588-friendlyelec-cm3588 (Tom Vincent)
- LTS version: v6.12.29 (Jack Vogel)
- arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977004] {CVE-2025-37963}
- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976926] {CVE-2025-37948}
- arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
- arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
- arm64: insn: Add support for encoding DSB (James Morse)
- mm: page_alloc: speed up fallbacks in rmqueue_bulk() (Johannes Weiner)
- mm: page_alloc: don't steal single pages from biggest buddy (Johannes Weiner)
- Bluetooth: btmtk: Remove the resetting step before downloading the fw (Hao Qin)
- Bluetooth: btmtk: Remove resetting mt7921 before downloading the fw (Hao Qin)
- io_uring: always arm linked timeouts prior to issue (Jens Axboe)
- rust: clean Rust 1.88.0's `clippy::uninlined_format_args` lint (Miguel Ojeda)
- rust: allow Rust 1.87.0's `clippy::ptr_eq` lint (Miguel Ojeda)
- Revert "um: work around sched_yield not yielding in time-travel mode" (Christian Lamparter)
- do_umount(): add missing barrier before refcount checks in sync case (Al Viro)
- io_uring/sqpoll: Increase task_work submission batch size (Gabriel Krisman Bertazi)
- drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs (Tejas Upadhyay)
- drm/xe/tests/mocs: Update xe_force_wake_get() return handling (Himal Prasad Ghimiray)
- riscv: misaligned: enable IRQs while handling misaligned accesses (Clément Léger)
- riscv: misaligned: factorize trap handling (Clément Léger)
- nvme: unblock ctrl state transition for firmware update (Daniel Wagner)
- drm/panel: simple: Update timings for AUO G101EVN010 (Kevin Baker)
- loop: Add sanity check for read/write_iter (Lizhi Xu)
- loop: factor out a loop_assign_backing_file helper (Christoph Hellwig)
- loop: refactor queue limits updates (Christoph Hellwig)
- loop: Fix ABBA locking race (Ogawa Hirofumi)
- loop: Simplify discard granularity calc (John Garry)
- loop: Use bdev limit helpers for configuring discard (John Garry)
- riscv: misaligned: Add handling for ZCB instructions (Nylon Chen)
- MIPS: Fix MAX_REG_OFFSET (Thorsten Blum)
- iio: adc: dln2: Use aligned_s64 for timestamp (Jonathan Cameron)
- iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64 (Jonathan Cameron)
- types: Complement the aligned types with signed 64-bit one (Andy Shevchenko)
- iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer. (Jonathan Cameron)
- iio: accel: adxl367: fix setting odr for activity time update (Lothar Rubusch)
- usb: usbtmc: Fix erroneous generic_read ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous wait_srq ioctl return (Dave Penkler)
- usb: usbtmc: Fix erroneous get_stb ioctl error returns (Dave Penkler)
- USB: usbtmc: use interruptible sleep in usbtmc_read (Oliver Neukum)
- usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015126] {CVE-2025-37994}
- usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition (Rd Babiera)
- usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs (Lukasz Czechowski)
- usb: host: tegra: Prevent host controller crash when OTG port is used (Jim Lin)
- usb: gadget: Use get_status callback to set remote wakeup capability (Prashanth K)
- usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN (Wayne Chang)
- usb: gadget: f_ecm: Add get_status callback (Prashanth K)
- usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version (Pawel Laszczak)
- usb: cdnsp: Fix issue with resuming from L1 (Pawel Laszczak)
- usb: dwc3: gadget: Make gadget_wakeup asynchronous (Prashanth K)
- x86/microcode: Consolidate the loader enablement checking (Borislav Petkov)
- module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015131] {CVE-2025-37995}
- memblock: Accept allocated memory before use in memblock_double_array() (Tom Lendacky) [Orabug: 37976994] {CVE-2025-37960}
- clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() (Sebastian Andrzej Siewior)
- arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong idmap generation (Levi Yun)
- accel/ivpu: Increase state dump msg timeout (Jacek Lawrynowicz)
- xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976934] {CVE-2025-37949}
- xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it (John Ernberg)
- smb: client: Avoid race in open_cached_dir with lease breaks (Paul Aurich) [Orabug: 37976959] {CVE-2025-37954}
- usb: uhci-platform: Make the clock really optional (Alexey Charkov)
- drm/amdgpu/hdp7: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush (Alex Deucher)
- drm/amd/display: Copy AUX read reply data whenever length &gt; 0 (Wayne Lin)
- drm/amd/display: Fix wrong handling for AUX_DEFER case (Wayne Lin)
- drm/amd/display: Remove incorrect checking in dmub aux handler (Wayne Lin)
- drm/amd/display: Fix the checking condition in dmub aux handling (Wayne Lin)
- drm/amd/display: more liberal vmin/vmax update for freesync (Aurabindo Pillai)
- drm/amd/display: Fix invalid context error in dml helper (Roman Li) [Orabug: 37977185] {CVE-2025-37965}
- drm/amdgpu/vcn: using separate VCN1_AON_SOC offset (Ruijing Dong)
- drm/xe: Add page queue multiplier (Matthew Brost)
- drm/v3d: Add job to pending list if the reset was skipped (Maíra Canal) [Orabug: 37976942] {CVE-2025-37951}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug: 37977031] {CVE-2025-37969}
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977037] {CVE-2025-37970}
- iio: imu: inv_mpu6050: align buffer for timestamp (David Lechner)
- iio: adis16201: Correct inclinometer channel resolution (Gabriel)
- iio: adc: rockchip: Fix clock initialization sequence (Simon Xue)
- iio: adc: ad7606: fix serial register access (Angelo Dureghello)
- io_uring: ensure deferred completions are flushed for multishot (Jens Axboe)
- drm/amd/display: Shift DMUB AUX reply command if necessary (Wayne Lin)
- KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (Mikhail Lobanov) [Orabug: 37976977] {CVE-2025-37957}
- selftests/mm: fix a build failure on powerpc (Nysal Jan K.A.)
- selftests/mm: compaction_test: support platform with huge mount of memory (Feng Tang)
- mm/userfaultfd: fix uninitialized output field for -EAGAIN race (Peter Xu)
- mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976982] {CVE-2025-37958}
- mm: fix folio_pte_batch() on XEN PV (Petr Vaněk)
- x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (Dave Hansen) [Orabug: 37977013] {CVE-2025-37964}
- staging: axis-fifo: Correct handling of tx_fifo_depth for size validation (Gabriel)
- staging: axis-fifo: Remove hardware resets for user errors (Gabriel)
- staging: bcm2835-camera: Initialise dev in v4l2_dev (Dave Stevenson) [Orabug: 37977042] {CVE-2025-37971}
- staging: iio: adc: ad7816: Correct conditional logic for store mode (Gabriel)
- rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration (Miguel Ojeda)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.87.0 (Miguel Ojeda)
- rust: clean Rust 1.88.0's `unnecessary_transmutes` lint (Miguel Ojeda)
- Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 (Aditya Garg)
- Input: synaptics - enable SMBus for HP Elitebook 850 G1 (Dmitry Torokhov)
- Input: synaptics - enable InterTouch on Dell Precision M3800 (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30L-G (Aditya Garg)
- Input: synaptics - enable InterTouch on Dynabook Portege X30-D (Manuel Fombuena)
- Input: xpad - fix two controller table values (Vicki Pfau)
- Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller (Lode Willems)
- Input: xpad - fix Share button on Xbox One controllers (Vicki Pfau)
- Input: mtk-pmic-keys - fix possible null pointer dereference (Gary Bisson) [Orabug: 37977044] {CVE-2025-37972}
- Input: cyttsp5 - fix power control issue on wakeup (Mikael Gonella-Bolduc)
- Input: cyttsp5 - ensure minimum reset pulse width (Hugo Villeneuve)
- virtio-net: fix total qstat values (Jakub Kicinski)
- net: export a helper for adding up queue stats (Jakub Kicinski)
- fbnic: Do not allow mailbox to toggle to ready outside fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Pull fbnic_fw_xmit_cap_msg use out of interrupt context (Alexander Duyck)
- fbnic: Improve responsiveness of fbnic_mbx_poll_tx_ready (Alexander Duyck)
- fbnic: Actually flush_tx instead of stalling out (Alexander Duyck)
- fbnic: Gate AXI read/write enabling on FW mailbox (Alexander Duyck)
- fbnic: Fix initialization of mailbox descriptor rings (Alexander Duyck)
- net: dsa: b53: do not set learning and unicast/multicast on up (Jonas Gorski)
- net: dsa: b53: fix learning on VLAN unaware bridges (Jonas Gorski)
- net: dsa: b53: fix toggling vlan_filtering (Jonas Gorski)
- net: dsa: b53: do not program vlans when vlan filtering is off (Jonas Gorski)
- net: dsa: b53: do not allow to configure VLAN 0 (Jonas Gorski)
- net: dsa: b53: always rejoin default untagged VLAN on bridge leave (Jonas Gorski)
- net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave (Jonas Gorski)
- net: dsa: b53: fix flushing old pvid VLAN on pvid change (Jonas Gorski)
- net: dsa: b53: fix clearing PVID of a port (Jonas Gorski)
- net: dsa: b53: keep CPU port always tagged again (Jonas Gorski)
- net: dsa: b53: allow leaky reserved multicast (Jonas Gorski)
- bpf: Scrub packet on bpf_redirect_peer (Paul Chaignon) [Orabug: 37976990] {CVE-2025-37959}
- netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015141] {CVE-2025-37997}
- ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [Orabug: 37976996] {CVE-2025-37961}
- erofs: ensure the extra temporary copy is valid for shortened bvecs (Gao Xiang)
- ice: use DSN instead of PCI BDF for ice_adapter index (Przemek Kitszel)
- ice: Initial support for E825C hardware in ice_adapter (Sergey Temerkhanov)
- wifi: mac80211: fix the type of status_code for negotiated TID to Link Mapping (Michael-Cy Lee)
- can: gw: fix RCU/BH usage in cgw_create_job() (Oliver Hartkopp)
- can: mcp251xfd: fix TDC setting for low data bit rates (Kelsey Maes)
- can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe (Antonios Salios) [Orabug: 38015123] {CVE-2025-37993}
- net: ethernet: mtk_eth_soc: do not reset PSE when setting FE (Frank Wunderlich)
- net: ethernet: mtk_eth_soc: reset all TX queues on DMA free (Daniel Golle)
- gre: Fix again IPv6 link-local address generation. (Guillaume Nault)
- virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (Jakub Kicinski) [Orabug: 37976969] {CVE-2025-37955}
- virtio_net: xsk: bind/unbind xsk for tx (Xuan Zhuo)
- sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 37977176] {CVE-2025-37953}
- s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
- ksmbd: fix memory leak in parse_lease_state() (Zhaolong Wang) [Orabug: 37977180] {CVE-2025-37962}
- openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015148] {CVE-2025-37998}
- ksmbd: Fix UAF in __close_file_table_ids (Sean Heelan) [Orabug: 37976951] {CVE-2025-37952}
- ksmbd: prevent out-of-bounds stream writes by validating *pos (Norbert Szetei) [Orabug: 37976923] {CVE-2025-37947}
- ksmbd: prevent rename with empty string (Namjae Jeon) [Orabug: 37976972] {CVE-2025-37956}
- can: rockchip_canfd: rkcanfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls (Marc Kleine-Budde)
- s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Niklas Schnelle) [Orabug: 37976920] {CVE-2025-37946}
- vfio/pci: Align huge faults to order (Alex Williamson)
- wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation (Veerendranath Jakkam) [Orabug: 37977046] {CVE-2025-37973}
- s390/pci: Fix missing check for zpci_create_device() error return (Niklas Schnelle) [Orabug: 37977050] {CVE-2025-37974}
- can: mcan: m_can_class_unregister(): fix order of unregistration calls (Marc Kleine-Budde)
- firmware: arm_scmi: Fix timeout checks on polling path (Cristian Marussi)
- arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2 (Wojciech Dubowik)
- Revert "btrfs: canonicalize the device path before adding it" (Qu Wenruo)
- fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (Max Kellermann) [Orabug: 38015155] {CVE-2025-37999}
- dm: add missing unlock on in dm_keyslot_evict() (Dan Carpenter)
- mm/vmscan: wake up flushers conditionally to avoid cgroup OOM (Zeng Jingxiang) [Orabug: 37480932]
- dmaengine: idxd: Narrow the restriction on BATCH to ver. 1 only (Vinicius Costa Gomes) [Orabug: 37801355]
- uek-rpm: build the fwctl mlx5 driver on UEK (Qing Huang) [Orabug: 37810636]
- fwctl: Adapt upstream code for UEK8 (Mikhael Goikhman) [Orabug: 37810636]
- mlx5: Create an auxiliary device for fwctl_mlx5 (Saeed Mahameed) [Orabug: 37810636]
- fwctl/mlx5: Support for communicating with mlx5 fw (Saeed Mahameed) [Orabug: 37810636]
- fwctl: Add documentation (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware (Jason Gunthorpe) [Orabug: 37810636]
- taint: Add TAINT_FWCTL (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: FWCTL_INFO to return basic information about the device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Basic ioctl dispatch for the character device (Jason Gunthorpe) [Orabug: 37810636]
- fwctl: Add basic structure for a class subsystem with a cdev (Jason Gunthorpe) [Orabug: 37810636]
- Revert "fwctl: Add basic structure for a class subsystem with a cdev" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Basic ioctl dispatch for the character device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_INFO to return basic information about the device" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Support for communicating with mlx5 fw" (Qing Huang) [Orabug: 37810636]
- Revert "mlx5: Create an auxiliary device for fwctl_mlx5" (Qing Huang) [Orabug: 37810636]
- Revert "taint: Add TAINT_FWCTL" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Adapt code for UEK-NEXT" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl/mlx5: Add INTERNAL_DEV_RES uctx capability" (Qing Huang) [Orabug: 37810636]
- Revert "fwctl: Allow up to 4k devices" (Qing Huang) [Orabug: 37810636]
- Revert "uek-rpm: build the fwctl mlx5 driver on UEK" (Qing Huang) [Orabug: 37810636]
- dmaengine: idxd: Change err messages to dbg (Jack Vogel) [Orabug: 37841831]
- PCI: Add PCI_VDEVICE_SUB helper macro (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbevf: Add support for Intel(R) E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Enable link management in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Clean up the E610 link management related code (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add ixgbe_x540 multiple header inclusion protection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for EEPROM dump in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for NVM handling in E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add link management support for E610 device (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 device capabilities detection (Piotr Kwapulinski) [Orabug: 37889575]
- ixgbe: Add support for E610 FW Admin Command Interface (Piotr Kwapulinski) [Orabug: 37889575]
- uek-rpm: Move the gve kernel module from extra to kernel-uek-core (Samasth Norway Ananda) [Orabug: 37940897]
- uek-rpm/config-aarch64: Enable BT_HCIUART_BCM for RPi Bluetooth (Vijay Kumar) [Orabug: 37961540]
- platform/mellanox: mlxbf-pmc: Support additional PMC blocks (Shravan Kumar Ramani) [Orabug: 37964051]
- mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug: 37964051,38037120] {CVE-2025-37866}
- mlxbf-bootctl: Support sysfs entries for RTC battery status (Xiangrong Li) [Orabug: 37964051]
- platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37964051]
- uek-rpm: CONFIG_PTP_1588_CLOCK_OCP enable for OCI (Vijayendra Suman) [Orabug: 37966384]
- x86/its: Fix build errors when CONFIG_MODULES=n (Eric Biggers) [Orabug: 37970148]
- x86/its: Use dynamic thunks for indirect branches (Peter Zijlstra) [Orabug: 37970148]
- x86/ibt: Keep IBT disabled during alternative patching (Pawan Gupta) [Orabug: 37970148]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 37989268]
- amd_hsmp: Increase the SMU timeout to 500ms (Vijay Kumar) [Orabug: 38000074]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge)  [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang)  [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming)  [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams)  [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson)  [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley)  [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson)  [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson)  [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang)  [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang)  [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang)  [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang)  [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang)  [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang)  [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang)  [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang)  [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang)  [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie)  [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie)  [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen)  [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen)  [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda)  [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda)  [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.1.el10uek]" date="1750939200">- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.2.el10uek]" date="1752148800">- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38178286]  {CVE-2025-38089}
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38162790]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38175263]
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)  [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)  [Orabug: 38175246]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.3.el10uek]" date="1752494400">- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38171405]</changelog>
</package>
<package pkgid="f4f7f46a65d572cd8587a4da6f420e83754423ef" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="102.36.5.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.2.el10uek]" date="1749729600">- net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741]
- tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759]
- LTS version: v6.12.33 (Jack Vogel)
- Revert "drm/amd/display: more liberal vmin/vmax update for freesync" (Aurabindo Pillai)
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang)
- dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky)
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist)
- Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski)
- usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- Revert "cpufreq: tegra186: Share policy per cluster" (Jonathan Hunter)
- block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122}
- PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal)
- accel/ivpu: Update power island delays (Karol Wachowski)
- accel/ivpu: Add initial Panther Lake support (Maciej Falkowski)
- rtc: Fix offset calculation for .start_secs &lt; 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- Documentation: ACPI: Use all-string data node references (Sakari Ailus)
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs &gt; 31 (Gabor Juhos)
- f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123}
- tracing: Fix compilation warning on arm32 (Pan Taixi)
- LTS version: v6.12.32 (Jack Vogel)
- ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon)
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon)
- platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson)
- ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang)
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori)
- NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust)
- char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi)
- drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa)
- drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia)
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman)
- spi: spi-sun4i: fix early activation (Alessandro Grassi)
- phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao)
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng)
- drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai)
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen)
- gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082}
- um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada)
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau)
- nfs: don't share pNFS DS connections between net namespaces (Jeff Layton)
- HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera)
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi)
- coredump: hand a pidfd to the usermode coredump helper (Christian Brauner)
- coredump: fix error handling for replace_fd() (Christian Brauner)
- perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy)
- perf/arm-cmn: Initialise cmn-&gt;cpu earlier (Robin Murphy)
- perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy)
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001}
- arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-main: Disable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Enable "serdes_wiz0" and "serdes_wiz1" (Siddharth Vadapalli)
- arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra)
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez)
- arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold)
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold)
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari)
- arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu)
- arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu)
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold)
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman)
- RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348]
- RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348]
- bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348]
- bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348]
- bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348]
- bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348]
- bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348]
- bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348]
- bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348]
- bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348]
- bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348]
- bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348]
- bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348]
- bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348]
- RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348]
- bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348]
- RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348]
- RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348]
- bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348]
- RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348]
- RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348]
- RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348]
- RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348]
- mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452]
- mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501]
- mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580]
- mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580]
- mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580]
- mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580]
- mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580]
- writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580]
- mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580]
- mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618]
- mm: multi-gen LRU: update lrugen-&gt;nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618]
- ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352]
- Reapply "ocfs2: fix sparse warnings" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: speed up chain-list searching" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: adjust enabling place for la window" (Gautham Ananthakrishna) [Orabug: 38041352]
- Reapply "ocfs2: improve write IO performance when fragmentation is high" (Gautham Ananthakrishna) [Orabug: 38041352]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.3.el10uek]" date="1750161600">- mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049]
- mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049]
- Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-101.33.4.el10uek]" date="1750766400">- rds: ib: Add cm_id generation scheme in order to detect new ones (Håkon Bugge) [Orabug: 37617972]
- uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang) [Orabug: 38006732]
- cxl/feature: Update out_len in set feature failure case (Li Ming) [Orabug: 38006732]
- cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams) [Orabug: 38006732]
- pds_fwctl: add Documentation entries (Shannon Nelson) [Orabug: 38006732]
- pds_fwctl: add rpc and query support (Brett Creeley) [Orabug: 38006732]
- pds_fwctl: initial driver framework (Shannon Nelson) [Orabug: 38006732]
- pds_core: add new fwctl auxiliary_device (Shannon Nelson) [Orabug: 38006732]
- cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang) [Orabug: 38006732]
- fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Set Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl/test: Add Get Feature support to cxl_test (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for set feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support to handle user feature commands for get feature (Dave Jiang) [Orabug: 38006732]
- cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Move cxl feature command structs to user header (Dave Jiang) [Orabug: 38006732]
- cxl: Add FWCTL support to CXL (Dave Jiang) [Orabug: 38006732]
- cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang) [Orabug: 38006732]
- cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose) [Orabug: 38006732]
- cxl/test: Add Get Supported Features mailbox command support (Dave Jiang) [Orabug: 38006732]
- cxl: Add Get Supported Features command for kernel usage (Dave Jiang) [Orabug: 38006732]
- cxl: Enumerate feature commands (Dave Jiang) [Orabug: 38006732]
- cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang) [Orabug: 38006732]
- vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie) [Orabug: 38053075]
- vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie) [Orabug: 38053233]
- sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen) [Orabug: 38070168]
- sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen) [Orabug: 38070168]
- uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda) [Orabug: 38091733]
- serial: update the rp2 driver code (Samasth Norway Ananda) [Orabug: 38091733]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger)  [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger)  [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan)  [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan)  [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan)  [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin)
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota)
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu)
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng)
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann)
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo)
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov)
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu)
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi)
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung)
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei Zhang)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Wentao Liang)
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold)
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-ji Chen)
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu)
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett)
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana)
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li (Intel))
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells)
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara)
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko)
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima)
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai)
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee)
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima)
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet)
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer)
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai)
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin)
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (SeongJae Park)
- smb: client: remove 	 from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima)
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski)
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev)
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo)
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski)
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang)
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin.Cao)
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng)
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke)
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun)
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (FUJITA Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin KaFai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu)
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra)
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher)
- smb: client: fix first command failure during re-negotiation (zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich)
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet)
- net: atm: add lec_mutex (Eric Dumazet)
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima)
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg)
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev)
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski)
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu)
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima)
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima)
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov)
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo)
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh AP)
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon)
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka)
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders)
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sá)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott)
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath SM)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal)
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn)
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis)
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam)
- Input: sparcspkr - avoid unannotated fall-through (WangYuli)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar)
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima)
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rong Zhang)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon)
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li (Intel))
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski)
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet)
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath SM)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin)
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov)
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang)
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton)
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes)
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook)
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Wentao Liang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij)
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo)
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner)
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu)
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh AP)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso)
- f2fs: fix to bail out in get_new_segment() (Chao Yu)
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski)
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R)
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin)
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao)
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S)
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (gldrk)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han)
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han)
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn)
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos)
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang)
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang)
- regulator: max14577: Add error check for max14577_read_reg() (Wentao Liang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel Shahrouzi)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann)
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz)
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin)
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Wentao Liang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Wentao Liang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams)
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'ichiro Kawasaki)
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park)
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (GONG Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov)
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu)
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim)
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski)
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han)
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu)
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim)
- f2fs: fix to do sanity check on ino and xnid (Chao Yu)
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter)
- ext4: only dirty folios when data journaling regular files (Brian Foster)
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo)
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis)
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko)
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin)
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeff Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar)
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski)
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian)
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev)
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis)
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li)
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Wentao Liang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis)
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park)
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann)
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng)
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (NeilBrown)
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh)
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter)
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Wentao Liang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Wentao Liang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Wentao Liang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F. R. A. Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li (Intel))
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner)
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov)
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt)
- 9p: Add a migrate_folio method (Matthew Wilcox (Oracle))
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (RD Babiera)
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby (SUSE))
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Wupeng Ma)
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard)
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov)
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge)
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox (Oracle))
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox (Oracle))
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig)
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang)
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana)
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski)
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet)
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet)
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet)
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin)
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz)
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski)
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski)
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj)
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui)
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani (IBM))
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet)
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang)
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park)
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz)
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav)
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold)
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro)
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki NAGAO)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski)
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel)
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal)
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari)
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song)
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng)
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré)
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré)
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak)
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas)
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen)
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Yeoreum Yun)
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz)
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (WangYuli)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang)
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin)
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar)
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin)
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang)
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng)
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe JAILLET)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe JAILLET)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski)
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin)
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov)
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin)
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov)
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin)
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei)
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Wentao Liang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher)
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F. R. A. Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo)
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima)
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam)
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur)
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang)
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (KaFai Wan)
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein)
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich)
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen)
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook)
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li RongQing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin)
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin)
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný)
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (ping.gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen)
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu)
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu)
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev)
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring (Arm))
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen)
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko)
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin)
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (YiFei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad)
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso)
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang)
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan)
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma)
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen XIN)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen XIN)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu)
- f2fs: prevent the current section from being selected as a victim during GC (yohan.joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter)
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu)
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen)
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen)
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang)
- xen/x86: fix initial memory balloon target (Roger Pau Monne)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon)
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A. R. Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin)
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe JAILLET)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao)
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao)
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland)
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown)
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han)
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian)
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo)
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot)
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong)
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu)
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F. R. A. Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu (Google))
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby (SUSE))
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait)
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper)
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli)  [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha)  [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137447]  {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky)  [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky)  [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli)  [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- Add normal counters (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly)  [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry)  [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson)  [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson)  [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry)  [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry)  [Orabug: 38026089]
- xfs: update atomic write limits (John Garry)  [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry)  [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry)  [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry)  [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry)  [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry)  [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry)  [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong)  [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong)  [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong)  [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry)  [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong)  [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry)  [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong)  [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong)  [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig)  [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig)  [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry)  [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry)  [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry)  [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry)  [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry)  [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry)  [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry)  [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry)  [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry)  [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry)  [Orabug: 38026089]
- dm-table: atomic writes support (John Garry)  [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry)  [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry)  [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry)  [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry)  [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry)  [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry)  [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry)  [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry)  [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry)  [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry)  [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry)  [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry)  [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani (IBM))  [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani (IBM))  [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry)  [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry)  [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry)  [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry)  [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry)  [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry)  [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha)  [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky)  [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek)  [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh)  [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas)  [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen)  [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge)  [Orabug: 38137957]
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge)  [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge)  [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna)  [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli)  [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli)  [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju)  [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.1.el10uek]" date="1754481600">- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann)  [Orabug: 38217337]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.2.el10uek]" date="1755086400">- iommu/vt-d: Fix misplaced domain_attached assignment (Ban ZuoXiang)  [Orabug: 38294635]</changelog>
</package>
<package pkgid="d7f5fe6d195e5a289b260f2cd131b2d1c329191f" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.33.1.el10uek]" date="1751371200">- net/mlx5: Expose ICM consumption per function (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Rename and move mlx5_esw_query_vport_vhca_id (Akiva Goldberger) [Orabug: 38063374]
- net/mlx5: Add nic_cap_reg and vhca_icm_ctrl registers (Akiva Goldberger) [Orabug: 38063374]
- mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo) [Orabug: 38092785]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38118654]
- net/rds: Add missing switch/break in rds_recv_worker() (Sharath Srinivasan) [Orabug: 38118666]
- net/rds: Merge uses of conn-&gt;c_destroy_in_prog &amp; RDS_DESTROY_PENDING (Sharath Srinivasan) [Orabug: 38118675]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
</package>
<package pkgid="5a35c5b6c1e066876dd41a1bcd118a16a63f54e9" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.2.el10uek]" date="1752062400">- LTS version: v6.12.36 (Jack Vogel)
- spi: fsl-qspi: Fix double cleanup in probe error path (Kevin Hao)
- btrfs: fix use-after-free on inode when scanning root during em shrinking (Sasha Levin) [Orabug: 38180088] {CVE-2025-21879}
- btrfs: zoned: fix extent range end unlock in cow_file_range() (Naohiro Aota) [Orabug: 38180166] {CVE-2025-21942}
- spi: fsl-qspi: use devm function instead of driver remove (Han Xu) [Orabug: 37937304] {CVE-2025-37842}
- net: stmmac: Fix accessing freed irq affinity_hint (Qingfang Deng) [Orabug: 37901643] {CVE-2025-23155}
- drm/amdkfd: Fix instruction hazard in gfx12 trap handler (Jay Cornwall)
- drm/amdkfd: remove gfx 12 trap handler page size cap (Jonathan Kim)
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA (Andres Traumann)
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi (Dragan Simic)
- riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg (Sasha Levin)
- btrfs: do regular iput instead of delayed iput during extent map shrinking (Filipe Manana)
- btrfs: make the extent map shrinker run asynchronously as a work queue job (Filipe Manana)
- btrfs: skip inodes without loaded extent maps when shrinking extent maps (Filipe Manana)
- drm/fbdev-dma: Add shadow buffering for deferred I/O (Thomas Zimmermann) [Orabug: 37766318] {CVE-2024-58091}
- drm/msm/dp: account for widebus and yuv420 during mode validation (Sasha Levin)
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY (Sasha Levin)
- drm/xe: Carve out wopcm portion from the stolen memory (Sasha Levin)
- iio: dac: ad3552r-common: fix ad3541/2r ranges (Angelo Dureghello)
- iio: dac: ad3552r: extract common code (no changes in behavior intended) (Angelo Dureghello)
- iio: dac: ad3552r: changes to use FIELD_PREP (Angelo Dureghello)
- btrfs: do proper folio cleanup when cow_file_range() failed (Qu Wenruo) [Orabug: 37649587] {CVE-2024-57976}
- net: phy: realtek: add RTL8125D-internal PHY (Heiner Kallweit)
- net: phy: realtek: merge the drivers for internal NBase-T PHY's (Heiner Kallweit)
- r8169: add support for RTL8125D (Heiner Kallweit)
- mm/vma: reset VMA iterator on commit_merge() OOM failure (Lorenzo Stoakes)
- io_uring/kbuf: flag partial buffer mappings (Jens Axboe)
- io_uring/net: mark iov as dynamically allocated even for single segments (Jens Axboe)
- io_uring/net: always use current transfer count for buffer put (Jens Axboe)
- io_uring/net: only consider msg_inq if larger than 1 (Jens Axboe)
- io_uring/net: only retry recv bundle for a full transfer (Jens Axboe)
- io_uring/net: improve recv bundles (Jens Axboe)
- io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
- io_uring/rsrc: fix folio unpinning (Pavel Begunkov) [Orabug: 38175088] {CVE-2025-38256}
- io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
- net: libwx: fix Tx L4 checksum (Jiawen Wu) [Orabug: 37844457] {CVE-2025-22101}
- x86/pkeys: Simplify PKRU update in signal frame (Chang S. Bae)
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE (Chang S. Bae)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- drm/amd/display: Fix mpv playback corruption on weston (Alex Hung)
- drm/amdgpu: switch job hw_fence to amdgpu_fence (Alex Deucher)
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences (Jesse Zhang)
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL (Ville Syrjälä)
- drm/xe: Fix early wedge on GuC load failure (Daniele Ceraolo Spurio)
- drm/xe: Fix taking invalid lock on wedge (Lucas De Marchi) [Orabug: 38253765] {CVE-2025-38353}
- drm/xe: Fix memset on iomem (Lucas De Marchi)
- drm/amd/display: Check dce_hwseq before dereferencing it (Alex Hung) [Orabug: 38253789] {CVE-2025-38361}
- drm/amdgpu: Add kicker device detection (Frank Min)
- drm/amd/display: Fix RMCM programming seq errors (Yihan Zhu)
- drm/xe/guc_submit: add back fix (Matthew Auld)
- drm/xe/sched: stop re-submitting signalled jobs (Matthew Auld)
- drm/xe/vm: move rebind_work init earlier (Matthew Auld)
- drm/amd/display: Correct non-OLED pre_T11_delay. (Zhongwei)
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram (John Olender)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253793] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot (Stephan Gerhold) [Orabug: 38253767] {CVE-2025-38354}
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253799] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- drm/etnaviv: Protect the scheduler's pending list with its lock (Maíra Canal)
- drm/cirrus-qemu: Fix pitch programming (Thomas Zimmermann)
- drm/ast: Fix comment on modeset lock (Thomas Zimmermann)
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore (Anvithdosapati)
- scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175024] {CVE-2025-38239}
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only (Iusico Maxim)
- f2fs: fix to zero post-eof page (Chao Yu)
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" (David Hildenbrand)
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (Liam R. Howlett) [Orabug: 38253803] {CVE-2025-38364}
- net: libwx: fix the creation of page_pool (Jiawen Wu)
- spi: spi-cadence-quadspi: Fix pm runtime unbalance (Khairul Anuar Romli)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- btrfs: fix a race between renames and directory logging (Filipe Manana) [Orabug: 38253806] {CVE-2025-38365}
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- serial: imx: Restore original RXTL for console to fix data loss (Fabio Estevam)
- serial: core: restore of_node information in sysfs (Aidan Stewart)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- x86/traps: Initialize DR6 by writing its architectural reset value (Xin Li)
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs (Avadhut Naik)
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (David Howells)
- cifs: Fix the smbd_response slab to allow usercopy (David Howells) [Orabug: 38324203] {CVE-2025-38523}
- smb: client: make use of common smbdirect_socket_parameters (Stefan Metzmacher)
- smb: smbdirect: introduce smbdirect_socket_parameters (Stefan Metzmacher)
- smb: client: make use of common smbdirect_socket (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_socket.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect.h with public structures (Stefan Metzmacher)
- smb: client: make use of common smbdirect_pdu.h (Stefan Metzmacher)
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Stefan Metzmacher)
- smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [Orabug: 38175038] {CVE-2025-38244}
- drm/xe: Process deferred GGTT node removals on device unwind (Michal Wajdeczko) [Orabug: 38253772] {CVE-2025-38355}
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type (Jayesh Choudhary)
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback (Wolfram Sang)
- drm/i915: fix build error some more (Arnd Bergmann)
- drm/amd: Adjust output for discovery error handling (Mario Limonciello)
- drm/amdgpu/discovery: optionally use fw based ip discovery (Alex Deucher)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR (Salvatore Bonaccorso)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175041] {CVE-2025-38245}
- netlink: specs: tc: replace underscores with dashes in names (Jakub Kicinski)
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- libbpf: Fix possible use-after-free for externs (Adin Scannell)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175053] {CVE-2025-38246}
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: finish link init before RCU publish (Johannes Berg)
- wifi: mac80211: Create separate links for VLAN interfaces (Muna Sinada)
- wifi: mac80211: Add link iteration macro for link data (Muna Sinada)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- ethernet: ionic: Fix DMA mapping tests (Thomas Fourier)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175062] {CVE-2025-38249}
- Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175067] {CVE-2025-38250}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175076] {CVE-2025-38251}
- HID: wacom: fix crash in wacom_aes_battery_handler() (Thomas Zeitlhofer) [Orabug: 38175083] {CVE-2025-38253}
- drm/xe/display: Add check for alloc_ordered_workqueue() (Haoxiang Li)
- Revert "riscv: misaligned: fix sleeping function called during misaligned access handling" (Nam Cao)
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" (Nam Cao)
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() (Yu Kuai) [Orabug: 38175086] {CVE-2025-38255}
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175090] {CVE-2025-38257}
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15 (Oliver Schramm)
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write (Seongjae Park) [Orabug: 38175095] {CVE-2025-38258}
- smb: client: remove \t from TP_printk statements (Stefan Metzmacher)
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk (Niklas Cassel)
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38175006] {CVE-2025-38236}
- accel/ivpu: Trigger device recovery on engine reset/resume failure (Karol Wachowski)
- accel/ivpu: Add debugfs interface for setting HWS priority bands (Karol Wachowski)
- accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation (Karol Wachowski)
- accel/ivpu: Make command queue ID allocated on XArray (Karol Wachowski)
- accel/ivpu: Remove copy engine support (Andrzej Kacprowski)
- accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers (Karol Wachowski)
- PCI: apple: Set only available ports up (Janne Grunau)
- PCI: apple: Use helper function for_each_child_of_node_scoped() (Zhang Zekun)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38175097] {CVE-2025-38259}
- ASoC: codec: wcd9335: Convert to GPIO descriptors (Peng Fan)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158699] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent (Filipe Manana)
- btrfs: use unsigned types for constants defined as bit shifts (David Sterba)
- btrfs: factor out nocow ordered extent and extent map generation into a helper (Qu Wenruo)
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" (Joonas Lahtinen)
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 (Ville Syrjälä)
- btrfs: handle csum tree error with rescue=ibadroots correctly (Qu Wenruo) [Orabug: 38175101] {CVE-2025-38260}
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan (Ziqi Chen)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ASoC: rt1320: fix speaker noise when volume bar is 100% (Shuming Fan)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- riscv: add a data fence for CMODX in the kernel mode (Andy Chiu)
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set (Michael Grzeschik)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: gadget: f_hid: wake up readers on disable/unbind (Peter Korsgaard)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175112] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe() (Chenyuan Yang) [Orabug: 38253811] {CVE-2025-38368}
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos (Purva Yeshi)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices (Rengarajan S)
- um: use proper care when taking mmap lock during segfault (Benjamin Berg)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- drm/scheduler: signal scheduled fence when kill job (Lin Cao) [Orabug: 38254074] {CVE-2025-38436}
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock (Philip Yang)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175118] {CVE-2025-38263}
- amd/amdkfd: fix a kfd_process ref leak (Yifan Zhang)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175125] {CVE-2025-38264}
- nvme-tcp: fix I/O stalls on congested sockets (Hannes Reinecke)
- PCI: imx6: Add workaround for errata ERR051624 (Richard Zhu)
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port (Hector Martin)
- PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane (Wenbin Yao)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (Yi Sun) [Orabug: 38253813] {CVE-2025-38369}
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic' (Rudraksha Gupta)
- rust: module: place cleanup_module() in .exit.text section (Fujita Tomonori)
- ksmbd: provide zero as a unique ID to the Mac client (Namjae Jeon)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- NFSv4: xattr handlers should check for absent nfs filehandles (Scott Mayhew)
- cxl/region: Add a dev_err() on missing target list entries (Robert Richter)
- fuse: fix race between concurrent setattrs from multiple nodes (Guang Yuan Wu)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- dm vdo indexer: don't read request structure after enqueuing (Matthew Sakai)
- sunrpc: don't immediately retransmit on seqno miss (Nikhil Jha)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated (Sagi Grimberg)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode (Pali Rohár)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request (Pali Rohár)
- LTS version: v6.12.35 (Jack Vogel)
- bpftool: Fix cgroup command to only show cgroup bpf programs (Martin Kafai Lau)
- cifs: Remove duplicate fattr-&gt;cf_dtype assignment from wsl_to_fattr() function (Pali Rohár)
- gpio: mlxbf3: only get IRQ for device instance 0 (David Thompson)
- perf test: Directory file descriptor leak (Ian Rogers)
- perf evsel: Missed close() when probing hybrid core PMUs (Ian Rogers)
- gpio: pca953x: fix wrong error probe return value (Sascha Hauer)
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs (Anup Patel)
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls (Anup Patel)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180594] {CVE-2025-38320}
- perf/core: Fix WARN in perf_cgroup_switch() (Luo Gengkun)
- perf: Fix cgroup state vs ERROR (Peter Zijlstra)
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254028] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Stefan Metzmacher) [Orabug: 38158402] {CVE-2025-38179}
- smb: client: fix first command failure during re-negotiation (Zhangjian)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- smb: Log an error when close_all_cached_dirs fails (Paul Aurich) [Orabug: 38180601] {CVE-2025-38321}
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties (Akhil R)
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh (Avadhut Naik)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158404] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180610] {CVE-2025-38323}
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available (David Thompson)
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158411] {CVE-2025-38181}
- drm/xe/bmg: Update Wa_16023588340 (Vinay Belgaumkar)
- drm/xe/gt: Update handling of xe_force_wake_get return (Himal Prasad Ghimiray)
- drm/xe: Wire up device shutdown handler (Maarten Lankhorst)
- ublk: santizize the arguments from userspace when adding a device (Ronnie Sahlberg) [Orabug: 38158417] {CVE-2025-38182}
- net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (Alexey Kodanev) [Orabug: 38158420] {CVE-2025-38183}
- eth: fbnic: avoid double free when failing to DMA-map FW msg (Jakub Kicinski) [Orabug: 38180727] {CVE-2025-38341}
- tcp: fix passive TFO socket having invalid NAPI ID (David Wei)
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158423] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158430] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180616] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254009] {CVE-2025-38420}
- ptp: allow reading of currently dialed frequency to succeed on free-running clocks (Vladimir Oltean)
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset (Pavan Chebbi)
- bnxt_en: Add a helper function to configure MRU and RSS (Pavan Chebbi)
- eth: bnxt: fix out-of-range access of vnic_info array (Taehee Yoo) [Orabug: 37844650] {CVE-2025-22112}
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() (Kalesh Ap) [Orabug: 38158439] {CVE-2025-38186}
- net: netmem: fix skb_ensure_writable with unreadable skbs (Mina Almasry)
- ksmbd: add free_transport ops in ksmbd connection (Namjae Jeon) [Orabug: 38180823] {CVE-2025-38325}
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() (Chuyi Zhou)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13 (Vitaly Lifshits)
- ice: fix eswitch code memory leak in reset scenario (Grzegorz Nitka) [Orabug: 38253997] {CVE-2025-38417}
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jens Axboe)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180626] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (ltc4282) avoid repeated register write (Nuno Sa)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled (Tzung-Bi Shih)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- ionic: Prevent driver/fw getting out of sync on devcmd(s) (Brett Creeley)
- drm/ssd130x: fix ssd132x_clear_screen() columns (John Keeping)
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE (Connor Abbott) [Orabug: 38158445] {CVE-2025-38188}
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names (Connor Abbott)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/disp: Correct porch timing for SDM845 (James A. MacInnes)
- smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels (Bharath Sm)
- ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn) [Orabug: 38175246]
- ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn) [Orabug: 38175246]
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c (Nathan Chancellor)
- Kunit to check the longest symbol length (Sergio González Collado)
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` (Maíra Canal) [Orabug: 38158447] {CVE-2025-38189}
- nfsd: use threads array as-is in netlink interface (Jeff Layton)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- rust: compile libcore with edition 2024 for 1.87+ (Gary Guo)
- kbuild: rust: add rustc-min-version support function (Miguel Ojeda)
- drm/amdgpu: read back register after written for VCN v4.0.5 (David (Ming Qiang) Wu)
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132168] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: Add quirk for Asus GU605C (Richard Fitzgerald)
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA (Chris Chiu)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx (Edip Hazuri)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 37844643] {CVE-2025-22119}
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path (Manivannan Sadhasivam) [Orabug: 37844541] {CVE-2025-22128}
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update (Dhananjay Ugwekar) [Orabug: 37844700] {CVE-2025-23137}
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power (Ping-Ke Shih)
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158456] {CVE-2025-38190}
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() (Tejun Heo)
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (Srinivas Pandruvada)
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- ksmbd: fix null pointer dereference in destroy_previous_session (Namjae Jeon) [Orabug: 38158463] {CVE-2025-38191}
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Kai Huang)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- mm: close theoretical race where stale TLB entries could linger (Ryan Roberts)
- net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158470] {CVE-2025-38192}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158475] {CVE-2025-38193}
- nvme: always punt polled uring_cmd end_io work to task_work (Jens Axboe)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- smb: improve directory cache reuse for readdir operations (Bharath Sm)
- cifs: do not disable interface polling on failure (Shyam Prasad N)
- cifs: serialize other channels when query server interfaces is pending (Shyam Prasad N)
- cifs: deal with the channel loading lag while picking channels (Shyam Prasad N)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180634] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158482] {CVE-2025-38194}
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() (Tianyang Zhang) [Orabug: 38158775] {CVE-2025-38195}
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg (Huacai Chen)
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers (Thomas Weißschuh)
- platform/loongarch: laptop: Add backlight power control support (Yao Zi)
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit (Yao Zi)
- platform/loongarch: laptop: Get brightness setting from EC on probe (Yao Zi)
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137452] {CVE-2025-38090}
- io_uring: fix task leak issue in io_wq_create() (Penglei Jiang)
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks (Jens Axboe)
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- powerpc/vdso: Fix build of VDSO32 with pcrel (Christophe Leroy)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158493] {CVE-2025-38197}
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice (Mario Limonciello)
- platform/x86/amd: pmc: Clear metrics table at start of cycle (Mario Limonciello)
- fs/xattr.c: fix simple_xattr_list() (Stephen Smalley)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- fbcon: Make sure modelist not set on unregistered console (Kees Cook) [Orabug: 38158496] {CVE-2025-38198}
- net/mlx5: HWS, Harden IP version definer checks (Vlad Dogaru)
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz (Suraj P Kizhakkethil)
- wifi: ath12k: fix incorrect CE addresses (Balamurugan S)
- wifi: ath12k: fix link valid field initialization in the monitor Rx (Hari Chandrakanthan)
- wifi: ath11k: determine PM policy based on machine model (Baochen Qiang)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- net: ethernet: cortina: Use TOE/TSO on all TCP (Linus Walleij) [Orabug: 38180658] {CVE-2025-38331}
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- f2fs: fix to set atomic write status more clear (Chao Yu)
- usbnet: asix AX88772: leave the carrier control to phylink (Krzysztof Hałasa)
- ice: fix check for existing switch rule (Mateusz Pacuszka)
- RDMA/hns: initialize db in update_srq_db() (Chen Linxuan)
- ixgbe: Fix unreachable retry logic in combined and byte I2C write functions (Rand Deeb)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158516] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180666] {CVE-2025-38332}
- wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping (Aditya Kumar Singh)
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry (Jonas 'Sortie' Termansen)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180729] {CVE-2025-38342}
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER (Michael Walle)
- wifi: ath12k: using msdu end descriptor to check for rx multicast packets (Sarika Sharma)
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp (Kalesh Ap)
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- net: bridge: mcast: update multicast contex when vlan state is changed (Yong Wang)
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 (Víctor Gonzalo)
- Revert "mac80211: Dynamically set CoDel parameters per station" (Toke Høiland-Jørgensen)
- wifi: mac80211: VLAN traffic in multicast path (Muna Sinada)
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index (Shung-Hsi Yu)
- net/mlx5: HWS, Fix IP version decision (Vlad Dogaru)
- netdevsim: Mark NAPI ID on skb in nsim_rcv (Joe Damato)
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled (Edward Adam Davis)
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting (Kuan-Chung Chen)
- wifi: iwlwifi: pcie: make sure to lock rxq-&gt;read (Miri Korenblit)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: smartpqi: Add new PCI IDs (David Strahan)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) [Orabug: 38158525] {CVE-2025-38201}
- f2fs: fix to bail out in get_new_segment() (Chao Yu) [Orabug: 38180672] {CVE-2025-38333}
- wifi: iwlwifi: mvm: fix beacon CCK flag (Johannes Berg)
- hid-asus: check ROG Ally MCU version and warn (Luke D. Jones)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() (Salah Triki)
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi (Stefan Wahren)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- libbpf: Check bpf_map_skeleton link for NULL (Mykyta Yatsenko)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- net: stmmac: generate software timestamp just before the doorbell (Jason Xing)
- bpf: Pass the same orig_call value to trampoline functions (Ilya Leoshkevich)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- xfrm: validate assignment of maximal possible SEQ number (Leon Romanovsky)
- net: page_pool: Don't recycle into cache on PREEMPT_RT (Sebastian Andrzej Siewior)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- x86/sgx: Prevent attempts to reclaim poisoned pages (Andrew Zaborowski) [Orabug: 38180683] {CVE-2025-38334}
- tcp: add receive queue awareness in tcp_rcv_space_adjust() (Eric Dumazet)
- tcp: fix initial tp-&gt;rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: remove zero TCP TS samples for autotuning (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode (Dian-Syuan Yang)
- iommu/amd: Allow matching ACPI HID devices without matching UIDs (Mario Limonciello)
- wifi: ath11k: Fix QMI memory reuse logic (Muhammad Usama Anjum)
- wifi: ath12k: fix a possible dead lock caused by ab-&gt;base_lock (Baochen Qiang)
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET (Kang Yang)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks (Taniya Das)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254037] {CVE-2025-38425}
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- libbpf/btf: Fix string handling to support multi-split BTF (Alan Maguire)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO (Aditya Kumar Singh)
- wifi: mt76: mt7925: introduce thermal protection (Leon Yen)
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device (Samuel Williams)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 (Jiande Lu)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (Benjamin Lin) [Orabug: 38180737] {CVE-2025-38343}
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 (Liwei Sun)
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (Hou Tao) [Orabug: 38158533] {CVE-2025-38202}
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx (Chao Yu)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (Rengarajan S) [Orabug: 38254019] {CVE-2025-38422}
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- ACPI: battery: negate current when discharging (Peter Marheine)
- power: supply: max17040: adjust thermal channel scaling (Svyatoslav Ryhel)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- gpiolib: of: Add polarity quirk for s5m8767 (Peng Fan)
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern (Linus Torvalds)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() (Frank Li)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- pmdomain: core: Reset genpd-&gt;states to avoid freeing invalid data (Ulf Hansson)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops (Stefan Binding)
- ACPICA: Apply pack(1) to union aml_resource (Tamir Duberstein)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180746] {CVE-2025-38344}
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case (Mario Limonciello)
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init() (I Hsin Cheng)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- mmc: Add quirk to disable DDR50 tuning (Erick Shepherd)
- power: supply: collie: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 (Talhah Peerbhai)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180753] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build (Arthur-Prince)
- iio: adc: ad7944: mask high bits on direct read (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132179] {CVE-2025-38085}
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- accel/ivpu: Fix warning in ivpu_gem_bo_free() (Jacek Lawrynowicz)
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex (Jacek Lawrynowicz)
- accel/ivpu: Use firmware names from upstream repo (Jacek Lawrynowicz)
- accel/ivpu: Improve buffer object logging (Jacek Lawrynowicz)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up() (Shawn Lin)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary (Long Li)
- smb: client: add NULL check in automount_fullpath (Ruben Devos) [Orabug: 38158578] {CVE-2025-38208}
- cifs: dns resolution is needed only for primary channel (Shyam Prasad N)
- cifs: update dstaddr whenever channel iface is updated (Shyam Prasad N)
- cifs: reset connections for all channels when reconnect requested (Shyam Prasad N)
- remoteproc: k3-m4: Don't assert reset in detach routine (Beleswar Padhi)
- remoteproc: core: Release rproc-&gt;clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254000] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254005] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- ovl: Fix nested backing file paths (André Almeida)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- pwm: axi-pwmgen: fix missing separate external clock (David Lechner)
- video: screen_info: Relocate framebuffers behind PCI bridges (Thomas Zimmermann) [Orabug: 38254049] {CVE-2025-38427}
- sysfb: Fix screen_info type check for VGA (Thomas Zimmermann)
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY (Lorenzo Stoakes)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132187] {CVE-2025-38086}
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property() (Xu Yang)
- dm: lock limits when reading them (Mikulas Patocka)
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180766] {CVE-2025-38346}
- mtd: rawnand: qcom: Fix read len for onfi param page (Md Sadre Alam)
- dm-verity: fix a memory leak if some arguments are specified multiple times (Mikulas Patocka)
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs (Yosry Ahmed)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- firmware: arm_scmi: Ensure that the message-id supports fastchannel (Sibi Sankar)
- configfs-tsm-report: Fix NULL dereference of tsm_ops (Dan Williams) [Orabug: 38158587] {CVE-2025-38210}
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events (Johan Hovold)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158590] {CVE-2025-38211}
- watchdog: fix watchdog may detect false positive of softlockup (Luo Gengkun)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158596] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- parisc/unaligned: Fix hex output to show 8 hex chars (Helge Deller)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158613] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158624] {CVE-2025-38215}
- iommu/vt-d: Restore context entry setup order for aliased devices (Lu Baolu) [Orabug: 38158633] {CVE-2025-38216}
- net: ftgmac100: select FIXED_PHY (Heiner Kallweit)
- net/sched: fix use-after-free in taprio_dev_notifier (Hyunwoo Kim) [Orabug: 38137441] {CVE-2025-38087}
- NFC: nci: uart: Set tty-&gt;disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253990] {CVE-2025-38416}
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read() (Gui-Dong Han) [Orabug: 38158635] {CVE-2025-38217}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158638] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158646] {CVE-2025-38219}
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180772] {CVE-2025-38347}
- Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() (Gatien Chevallier)
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254052] {CVE-2025-38428}
- ext4: only dirty folios when data journaling regular files (Brian Foster) [Orabug: 38158657] {CVE-2025-38220}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158660] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: ahci: Disallow LPM for Asus B550-F motherboard (Mikko Korhonen)
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard (Niklas Cassel)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180695] {CVE-2025-38336}
- bus: firewall: Fix missing static inline annotations for stubs (Krzysztof Kozlowski)
- cgroup,freezer: fix incomplete freezing when attaching tasks (Chen Ridong)
- ceph: set superblock s_magic for IMA fsmagic matching (Dennis Marttinen)
- ceph: avoid kernel BUG for encrypted inode with unaligned file size (Viacheslav Dubeyko) [Orabug: 38158671] {CVE-2025-38223}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic (Fedor Pchelkin) [Orabug: 38158777] {CVE-2025-38224}
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- bus: mhi: ep: Update read pointer only after buffer is written (Sumit Kumar) [Orabug: 38254058] {CVE-2025-38429}
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion (Damien Le Moal)
- ASoC: codecs: wcd937x: Drop unused buck_supply (Krzysztof Kozlowski)
- ASoC: codecs: wcd9375: Fix double free of regulator supplies (Krzysztof Kozlowski) [Orabug: 38254026] {CVE-2025-38423}
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- arm64/mm: Close theoretical race where stale TLB entry remains valid (Ryan Roberts)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: imx-jpeg: Cleanup after an allocation error (Ming Qian) [Orabug: 38158675] {CVE-2025-38225}
- media: imx-jpeg: Reset slot data pointers when freed (Ming Qian)
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead (Ming Qian)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158679] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158684] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: mediatek: vcodec: Correct vsi_core framebuffer size (Fei Shao)
- media: ipu6: Remove workaround for Meteor Lake ES2 (Hao Yao)
- media: intel/ipu6: Fix dma mask for non-secure mode (Stanislaw Gruszka)
- media: imagination: fix a potential memory leak in e5010_probe() (Haoxiang Li) [Orabug: 38158688] {CVE-2025-38228}
- media: i2c: imx335: Fix frame size enumeration (Kieran Bingham)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158690] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place (Hans de Goede)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt() (Tomi Valkeinen)
- media: nxp: imx8-isi: better handle the m2m usage_count (Laurentiu Palcu)
- media: imx335: Use correct register width for HNUM (Umang Jain)
- media: ov5675: suppress probe deferral errors (Johan Hovold)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- wifi: rtw88: usb: Reduce control message timeout to 500 ms (Bitterblue Smith)
- svcrdma: Unregister the device if svc_rdma_accept() fails (Chuck Lever)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180704] {CVE-2025-38337}
- wifi: ath12k: fix ring-buffer corruption (Johan Hovold)
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() (Max Kellermann) [Orabug: 38180713] {CVE-2025-38338}
- NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew)
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls (Chuck Lever)
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158705] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254060] {CVE-2025-38430}
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute (Chuck Lever)
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158711] {CVE-2025-38232}
- NFSD: unregister filesystem in case genl_register_family() fails (Maninder Singh)
- wifi: ath11k: fix ring-buffer corruption (Johan Hovold)
- wifi: rtw88: usb: Upload the firmware in bigger chunks (Bitterblue Smith)
- wifi: ath11k: fix rx completion meta data corruption (Johan Hovold)
- wifi: mt76: mt7925: fix host interrupt register initialization (Michael Lo)
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180780] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- regulator: max20086: Change enable gpio to optional (João Paulo Gonçalves)
- regulator: max20086: Fix MAX200086 chip id (João Paulo Gonçalves)
- s390/pci: Serialize device addition and removal (Niklas Schnelle)
- s390/pci: Allow re-add of a reserved but not yet removed device (Niklas Schnelle)
- s390/pci: Prevent self deletion in disable_slot() (Niklas Schnelle)
- s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Niklas Schnelle)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- io_uring/kbuf: account ring io_buffer_list memory (Pavel Begunkov)
- io_uring: account drain memory to cgroup (Pavel Begunkov)
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() (Vijendar Mukunda)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- crypto: qat - add shutdown handler to qat_dh895xcc (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c62x (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_4xxx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_420xx (Giovanni Cabiddu)
- crypto: qat - add shutdown handler to qat_c3xxx (Giovanni Cabiddu)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- LTS version: v6.12.34 (Jack Vogel)
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit (Arnd Bergmann)
- drm/meson: Use 1000ULL when operating with mode-&gt;clock (I Hsin Cheng)
- gfs2: Don't clear sb-&gt;s_fs_info in gfs2_sys_fs_add (Andrew Price)
- overflow: Introduce __DEFINE_FLEX for having no initializer (Kees Cook)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n (Arnd Bergmann)
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement (Nícolas F R A Prado)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152862] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- xfs: don't assume perags are initialised when trimming AGs (Dave Chinner)
- ring-buffer: Move cpus_read_lock() outside of buffer-&gt;mutex (Steven Rostedt)
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (Dmitry Antipov) [Orabug: 38152865] {CVE-2025-38101}
- ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (Steven Rostedt) [Orabug: 38180430] {CVE-2025-38267}
- 9p: Add a migrate_folio method (Matthew Wilcox)
- usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work (Rd Babiera) [Orabug: 38180435] {CVE-2025-38268}
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence (Jonathan Stroud)
- tty: serial: 8250_omap: fix TX with DMA for am33xx (Jiri Slaby)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152867] {CVE-2025-38102}
- usb: usbtmc: Fix read_stb function and get_stb ioctl (Dave Penkler)
- nvmem: zynqmp_nvmem: unbreak driver after cleanup (Peter Korsgaard) [Orabug: 38180534] {CVE-2025-38301}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223085] {CVE-2025-38352}
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152875] {CVE-2025-38103}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- Revert "wifi: mwifiex: Fix HT40 bandwidth issue." (Francesco Dolcini)
- tools/resolve_btfids: Fix build when cross compiling kernel with clang. (Suleiman Souhlal)
- objtool/rust: relax slice condition to cover more `noreturn` Rust functions (Miguel Ojeda)
- block: Fix bvec_set_folio() for very large folios (Matthew Wilcox)
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP (Matthew Wilcox)
- io_uring: consistently use rcu semantics with sqpoll thread (Keith Busch)
- block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work (Christoph Hellwig) [Orabug: 38180537] {CVE-2025-38302}
- io_uring: fix use-after-free of sq-&gt;thread in __io_uring_show_fdinfo() (Penglei Jiang) [Orabug: 38152890] {CVE-2025-38106}
- block: use q-&gt;elevator with -&gt;elevator_lock held in elv_iosched_show() (Ming Lei)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- btrfs: exit after state split error at set_extent_bit() (Filipe Manana)
- gfs2: pass through holder from the VFS for freeze/thaw (Christian Brauner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit() (Filipe Manana) [Orabug: 38180438] {CVE-2025-38269}
- net: drv: netdevsim: don't napi_complete() from netpoll (Jakub Kicinski) [Orabug: 38180445] {CVE-2025-38270}
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152892] {CVE-2025-38107}
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152897] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105332] {CVE-2025-38083}
- net/mlx5e: Fix leak of Geneve TLV option object (Jianbo Liu)
- net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik)
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152902] {CVE-2025-38109}
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- Bluetooth: MGMT: Fix sparse errors (Luiz Augusto von Dentz)
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data (Luiz Augusto von Dentz) [Orabug: 38180540] {CVE-2025-38303}
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance (Luiz Augusto von Dentz)
- Bluetooth: Fix NULL pointer deference on eir_get_service_data (Luiz Augusto von Dentz) [Orabug: 38180542] {CVE-2025-38304}
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (Jakub Raczynski) [Orabug: 38152906] {CVE-2025-38110}
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152909] {CVE-2025-38111}
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152914] {CVE-2025-38112}
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38152918] {CVE-2025-38113}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137443] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152921] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins (Wojciech Slenska)
- spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted (Félix Piédallu)
- spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message (Félix Piédallu)
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() (Dan Carpenter)
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 (Baochen Qiang) [Orabug: 38253981] {CVE-2025-38414}
- wifi: ath12k: refactor ath12k_hw_regs structure (P Praneesh)
- wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready (Rodrigo Gobbi)
- wifi: ath11k: move some firmware stats related functions outside of debugfs (Baochen Qiang)
- wifi: ath11k: don't wait when there is no vdev started (Baochen Qiang)
- wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process() (Baochen Qiang)
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() (Baochen Qiang)
- wifi: ath11k: convert timeouts to secs_to_jiffies() (Easwar Hariharan)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp-&gt;n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180544] {CVE-2025-38305}
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0 (Jonas Gorski)
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [Orabug: 38152928] {CVE-2025-38117}
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (Dr. David Alan Gilbert)
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (Luiz Augusto von Dentz) [Orabug: 38152938] {CVE-2025-38118}
- Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Increase the tx and rx descriptor count (Chandrashekar Devegowda)
- Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers (Kiran K)
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage (Pauli Virtanen)
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152943] {CVE-2025-38119}
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- dt-bindings: pwm: adi,axi-pwmgen: Fix clocks (David Lechner)
- dt-bindings: pwm: Correct indentation and style in DTS example (Krzysztof Kozlowski)
- dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3 (Uwe Kleine-König)
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks (Peter Griffin)
- pinctrl: samsung: refactor drvdata suspend &amp; resume callbacks (Peter Griffin)
- arm64: dts: qcom: x1e80100: Add GPU cooling (Stephan Gerhold) [Orabug: 38147977] {CVE-2025-38093}
- arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown (Stephan Gerhold)
- mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 (Nicolas Frattaroli)
- pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() (Ulf Hansson)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
- ALSA: hda/realtek - Support mute led function for HP platform (Kailang Yang)
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA (Stefan Binding)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247 (Chris Chiu)
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315 (Chris Chiu)
- tools/power turbostat: Fix AMD package-energy reporting (Gautham R. Shenoy)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256448] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- path_overmount(): avoid false negatives (Al Viro)
- iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec (Nitesh Shetty)
- ASoC: ti: omap-hdmi: Re-add dai_link-&gt;platform to fix card init (Yuuki Nagao)
- ASoC: Intel: avs: Verify content returned by parse_int_array() (Cezary Rojewski) [Orabug: 38180550] {CVE-2025-38307}
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX (Cezary Rojewski)
- ASoC: codecs: hda: Fix RPM usage count underflow (Cezary Rojewski)
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init() (Nitin Rawat)
- riscv: misaligned: fix sleeping function called during misaligned access handling (Nylon Chen)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180554] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing (Daniele Palmas)
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (Lachlan Hodges)
- net: dsa: b53: do not touch DLL_IQQD on bcm53115 (Jonas Gorski)
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports (Jonas Gorski)
- net: dsa: b53: do not enable RGMII delay on bcm63xx (Jonas Gorski)
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces. (Meghana Malladi)
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry (Florian Westphal)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152956] {CVE-2025-38120}
- drm/panel-simple: fix the warnings for the Evervision VGG644804 (Michael Walle)
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152963] {CVE-2025-38122}
- nvme: fix command limits status code (Keith Busch)
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices (Rafael J. Wysocki)
- selftests: net: build net/lib dependency in all target (Bui Quang Minh)
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: wwan: t7xx: Fix napi rx poll issue (Jinjian Song) [Orabug: 38152967] {CVE-2025-38123}
- net: fix udp gso skb_segment after pull from frag_list (Shiming Cheng) [Orabug: 38152970] {CVE-2025-38124}
- drm/i915/guc: Handle race condition where wakeref count drops below 0 (Jesus Narvaez)
- drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP (Jouni Högander)
- drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h (Jesus Narvaez)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré) [Orabug: 38152972] {CVE-2025-38125}
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [Orabug: 38152977] {CVE-2025-38126}
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- idpf: avoid mailbox timeout delays during reset (Emil Tantilov)
- idpf: fix a race in txq wakeup (Brian Vazquez)
- ice: fix rebuilding the Tx scheduler tree for large queue counts (Michal Kubiak)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- ice: fix Tx scheduler error handling in XDP callback (Michal Kubiak) [Orabug: 38152985] {CVE-2025-38127}
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net: lan966x: Make sure to insert the vlan tags also in host mode (Horatiu Vultur)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- net: tipc: fix refcount warning in tipc_aead_encrypt (Charalampos Mitrodimas) [Orabug: 38180820] {CVE-2025-38273}
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152993] {CVE-2025-38129}
- Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated (Tengteng Yang)
- drm/xe: Make xe_gt_freq part of the Documentation (Rodrigo Vivi)
- loop: add file_start_write() and file_end_write() (Ming Lei)
- USB: typec: fix const issue in typec_match() (Greg Kroah-Hartman)
- USB: gadget: udc: fix const issue in gadget_match_driver() (Greg Kroah-Hartman)
- iio: adc: mcp3911: fix device dependent mappings for conversion result registers (Marcus Folkesson)
- iio: adc: PAC1934: fix typo in documentation link (Marius Cristea)
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array() (Hans de Goede)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- coresight: prevent deactivate active config while enabling the config (Levi Yun) [Orabug: 38152999] {CVE-2025-38131}
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() (Qasim Ijaz) [Orabug: 38180453] {CVE-2025-38274}
- counter: interrupt-cnt: Protect enable/disable OPs with mutex (Alexander Sverdlin)
- coresight: catu: Introduce refcount and spinlock for enabling/disabling (Yabin Cui)
- coresight: Fixes device's owner field for registered using coresight_init_driver() (Junhao He)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() (Chenyuan Yang) [Orabug: 38153007] {CVE-2025-38134}
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- iio: filter: admv8818: Support frequencies &gt;= 2^32 (Brian Pellegrino)
- iio: filter: admv8818: fix range calculation (Sam Winchenbach)
- iio: filter: admv8818: fix integer overflow (Sam Winchenbach)
- iio: filter: admv8818: fix band 4, state 15 (Sam Winchenbach)
- thunderbolt: Fix a logic error in wake on connect (Mario Limonciello)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153010] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153015] {CVE-2025-38136}
- PCI: endpoint: Retain fixed-size BAR size as well as aligned size (Jerome Brunet)
- rtc: loongson: Add missing alarm notifications for ACPI RTC events (Liu Dalin)
- PCI/DPC: Log Error Source ID only when valid (Bjorn Helgaas)
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root() (Zhe Qiao)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153028] {CVE-2025-38138}
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (Chenyuan Yang) [Orabug: 38180455] {CVE-2025-38275}
- PCI: apple: Use gpiod_set_value_cansleep in probe flow (Hector Martin)
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- PCI: rcar-gen4: set ep BAR4 fixed size (Jerome Brunet)
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() (Wilfred Mallawa)
- phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy-&gt;rate in case of errors (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Fix clock ratio setup (Cristian Ciocaltea)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- rust: alloc: add missing invariant in Vec::set_len() (Danilo Krummrich)
- cifs: Fix validation of SMB1 query reparse point response (Pali Rohár)
- perf callchain: Always populate the addr_location map when adding IP (Ian Rogers)
- perf trace: Set errpid to false for rseq and set_robust_list (Anubhav Shelat)
- nfs: ignore SB_RDONLY when remounting nfs (Li Lingfeng) [Orabug: 37781252]
- nfs: clear SB_RDONLY before getting superblock (Li Lingfeng)
- perf trace: Always print return value for syscalls returning a pid (Anubhav Shelat)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf symbol: Fix use-after-free in filename__read_build_id (Ian Rogers)
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting (Jason-JH Lin)
- mailbox: imx: Fix TXDB_V2 sending (Peng Fan)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick} (Siddharth Vadapalli)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf intel-pt: Fix PEBS-via-PT data_src (Adrian Hunter)
- perf tests: Fix 'perf report' tests installation (Michael Petlan)
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids() (Namhyung Kim)
- dm-flakey: make corrupting read bios work (Benjamin Marzinski)
- dm-flakey: error all IOs when num_features is absent (Benjamin Marzinski)
- dm: fix dm_blk_report_zones (Benjamin Marzinski) [Orabug: 38153040] {CVE-2025-38141}
- perf symbol-minimal: Fix double free in filename__read_build_id (Ian Rogers)
- hwmon: (asus-ec-sensors) check sensor index in read_string() (Alexei Safin) [Orabug: 38153043] {CVE-2025-38142}
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (Mikhail Arkhipov) [Orabug: 38180461] {CVE-2025-38277}
- x86/irq: Ensure initial PIR loads are performed exactly once (Sean Christopherson)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153049] {CVE-2025-38143}
- dm: free table mempools if not used in __bind (Benjamin Marzinski)
- dm: don't change md if dm_table_set_restrictions() fails (Benjamin Marzinski)
- perf ui browser hists: Set actions-&gt;thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
- randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180564] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153058] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- ARM: aspeed: Don't select SRAM (Joel Stanley)
- arm64: dts: mt6359: Rename RTC node to match binding expectations (Julien Massot)
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups (Thuan Nguyen)
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects (Dmitry Baryshkov)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- arm64: defconfig: mediatek: enable PHY drivers (Vignesh Raman)
- ARM: dts: qcom: apq8064: move replicator out of soc node (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- ARM: dts: qcom: apq8064: add missing clocks to the timer node (Dmitry Baryshkov)
- dt-bindings: vendor-prefixes: Add Liontron name (Andre Przywara)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180570] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253983] {CVE-2025-38415}
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse (Barnabás Czémán)
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E (Prasanth Babu Mantena)
- arm64: tegra: Add uartd serial alias for Jetson TX1 module (Aaron Kling)
- arm64: tegra: Drop remaining serial clock-names and reset-names (Aaron Kling)
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series (Peter Robinson)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c (Peter Robinson)
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning (Alexey Minnekhanov)
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply (Alexey Minnekhanov)
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node (Julien Massot)
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles (Nícolas F R A Prado)
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio (Adam Ford)
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: mt8183: Add port node to mt8183.dtsi (Pin-Yen Lin)
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO (Alexey Minnekhanov)
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains (AngeloGioacchino Del Regno)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588 (Chukun Pan)
- arm64: dts: qcom: ipq9574: Fix USB vdd info (Varadarajan Narayanan)
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies (Stephan Gerhold)
- arm64: dts: qcom: sm8250: Fix CPU7 opp table (Xilin Wu)
- arm64: dts: qcom: sm8350: Reenable crypto &amp; cryptobam (Luca Weiss)
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: refactor node order (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake (Dzmitry Sankouski)
- arm64: dts: qcom: sdm845-starqltechn: remove wifi (Dzmitry Sankouski)
- arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on (Konrad Dybcio)
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node (Neil Armstrong)
- arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures (Neil Armstrong)
- arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent (Mark Kettenis)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry-&gt;d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153063] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153067] {CVE-2025-38147}
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback (Hariprasad Kelam) [Orabug: 38180463] {CVE-2025-38278}
- octeontx2-pf: QOS: Perform cache sync on send queue teardown (Hariprasad Kelam)
- net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153075] {CVE-2025-38148}
- net: lan743x: Fix PHY reset handling during initialization and WOL (Thangaraj Samynathan)
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Greg Kroah-Hartman)
- net: phy: clear phydev-&gt;devlink when the link is deleted (Wei Fang) [Orabug: 38153079] {CVE-2025-38149}
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180469] {CVE-2025-38280}
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit (Suraj Gupta)
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6 (Horatiu Vultur)
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work (Jack Morgenstein) [Orabug: 38153083] {CVE-2025-38151}
- vsock/virtio: fix `rx_bytes` accounting for stream sockets (Stefano Garzarella)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153087] {CVE-2025-38153}
- RISC-V: KVM: lock the correct mp_state during reset (Radim Krčmář)
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- netfilter: nf_tables: nft_fib: consistent l3mdev handling (Florian Westphal)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153093] {CVE-2025-38154}
- Bluetooth: btintel: Check dsbr size from EFI variable (Kees Cook) [Orabug: 38180581] {CVE-2025-38315}
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (Dmitry Antipov)
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds (Florian Westphal)
- bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" (Di Shen)
- wifi: mt76: mt7996: fix RX buffer size of MCU event (Shayne Chen)
- wifi: mt76: mt7996: set EHT max ampdu length capability (Peter Chiu)
- wifi: mt76: mt7925: ensure all MCU commands wait for response (Michael Lo)
- wifi: mt76: mt7925: refine the sniffer commnad (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent multiple scan commands (Ming Yen Hsieh)
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() (Henry Martin) [Orabug: 38153099] {CVE-2025-38155}
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() (Henry Martin) [Orabug: 38153103] {CVE-2025-38156}
- Bluetooth: ISO: Fix not using SID from adv report (Luiz Augusto von Dentz)
- kernfs: Relax constraint in draining guard (Michal Koutný) [Orabug: 38180476] {CVE-2025-38282}
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() (Ping Gao)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153107] {CVE-2025-38157}
- hisi_acc_vfio_pci: bugfix live migration function without VF device driver (Longfang Liu) [Orabug: 38180480] {CVE-2025-38283}
- hisi_acc_vfio_pci: add eq and aeq interruption restore (Longfang Liu)
- hisi_acc_vfio_pci: fix XQE dma address error (Longfang Liu) [Orabug: 38153117] {CVE-2025-38158}
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (Rajat Soni)
- iommu: remove duplicate selection of DMAR_TABLE (Rolf Eike Beer)
- wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips (Chin-Yen Lee)
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153120] {CVE-2025-38159}
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000 (Ping-Ke Shih)
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 &amp; mclk1 for 24 MHz (Vincent Knecht)
- dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference (Rob Herring)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180487] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180493] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- of: unittest: Unlock on error in unittest_data_add() (Dan Carpenter)
- tracing: Fix error handling in event_trigger_parse() (Miaoqian Lin)
- tracing: Rename event_trigger_alloc() to trigger_data_alloc() (Steven Rostedt)
- selftests/bpf: Fix caps for __xlated/jited_unpriv (Luis Gerhorst)
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd (Hans Zhang)
- wifi: iwlfiwi: mvm: Fix the rate reporting (Ilan Peer)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153129] {CVE-2025-38160}
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels (Yifei Zhu)
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- tracing: Move histogram trigger variables from stack to per CPU structure (Steven Rostedt)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153137] {CVE-2025-38161}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Pablo Neira Ayuso) [Orabug: 38153145] {CVE-2025-38162}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps (Lorenzo Bianconi)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels (Yi Zhang) [Orabug: 38180501] {CVE-2025-38288}
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- bonding: assign random address if device address is same as bond (Hangbin Liu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- Use thread-safe function pointer in libbpf_print (Jonathan Wiepert)
- libbpf: Remove sample_period init in perf_buffer (Tao Chen)
- libbpf: Fix event name too long error (Feng Yang)
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk (Yihang Li)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: ath12k: fix node corruption in ar-&gt;arvifs list (Maharaja Kennadyrajan) [Orabug: 38180505] {CVE-2025-38290}
- wifi: ath12k: Fix the QoS control field offset to build QoS header (Ramasamy Kaliappan)
- wifi: ath12k: Add MSDU length validation for TKIP MIC error (P Praneesh)
- wifi: ath12k: fix invalid access to memory (Sarika Sharma) [Orabug: 38180511] {CVE-2025-38292}
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally (Zhen Xin)
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT (Zhen Xin)
- xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu)
- net/mlx5: Avoid using xso.real_dev unnecessarily (Cosmin Ratiu)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen)
- page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen)
- f2fs: fix to do sanity check on sbi-&gt;total_valid_block_count (Chao Yu) [Orabug: 38153148] {CVE-2025-38163}
- f2fs: prevent the current section from being selected as a victim during GC (Yohan Joung)
- f2fs: clean up unnecessary indentation (Jaegeuk Kim)
- wifi: ath12k: Fix buffer overflow in debugfs (Dan Carpenter) [Orabug: 38180584] {CVE-2025-38317}
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc (Ramya Gnanasekar)
- wifi: ath12k: fix cleanup path after mhi init (Raj Kumar Bhagat)
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA (Chao Yu) [Orabug: 38153159] {CVE-2025-38164}
- bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38153161] {CVE-2025-38165}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- bpf: fix ktls panic with sockmap (Jiayuan Chen) [Orabug: 38153165] {CVE-2025-38166}
- selftests/bpf: Fix bpf_nf selftest failure (Saket Kumar Bhaskar)
- bpf: Check link_create.flags parameter for multi_kprobe (Tao Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath12k: Fix invalid memory access while forming 802.11 header (P Praneesh)
- wifi: ath12k: Fix memory leak during vdev_id mismatch (P Praneesh)
- wifi: ath11k: fix node corruption in ar-&gt;arvifs list (Stone Zhang) [Orabug: 38180514] {CVE-2025-38293}
- xen/x86: fix initial memory balloon target (Roger Pau Monné)
- svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
- media: verisilicon: Free post processor buffers on error (Detlev Casanova)
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err (AngeloGioacchino Del Regno)
- drm/mediatek: Fix kobject put for component sub-drivers (AngeloGioacchino Del Regno)
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr (AngeloGioacchino Del Regno)
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3 (Konrad Dybcio)
- selftests/seccomp: fix negative_ENOSYS tracer tests on arm32 (Terry Tritton)
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() (Anand Moon) [Orabug: 38180518] {CVE-2025-38295}
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- overflow: Fix direct struct member initialization in _DEFINE_FLEX() (Gustavo A R Silva)
- arm64/fpsimd: Do not discard modified SVE state (Mark Rutland)
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state-&gt;active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- drm/msm/dpu: enable SmartDMA on SC8180X (Dmitry Baryshkov)
- drm/msm/dpu: enable SmartDMA on SM8150 (Dmitry Baryshkov)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused (Mark Rutland)
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX (Kornel Dulęba)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- watchdog: exar: Shorten identity name to fit correctly (Kees Cook)
- kunit/usercopy: Disable u64 test on 32-bit SPARC (Thomas Weißschuh)
- fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr (Lizhi Xu)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153171] {CVE-2025-38167}
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe() (Christophe Jaillet)
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support (Casey Connolly)
- perf: arm-ni: Fix missing platform_set_drvdata() (Hongbo Yao) [Orabug: 38180586] {CVE-2025-38318}
- perf: arm-ni: Unregister PMUs on probe failure (Hongbo Yao) [Orabug: 38153175] {CVE-2025-38168}
- drm/panthor: Update panthor_mmu::irq::mask when needed (Boris Brezillon)
- drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions (Boris Brezillon)
- arm64/fpsimd: Fix merging of FPSIMD state during signal return (Mark Rutland)
- arm64/fpsimd: Reset FPMR upon exec() (Mark Rutland)
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (Mark Rutland) [Orabug: 38153177] {CVE-2025-38169}
- arm64/fpsimd: Don't corrupt FPMR when streaming mode changes (Mark Brown)
- arm64/fpsimd: Discard stale CPU state when handling SME traps (Mark Brown) [Orabug: 38153179] {CVE-2025-38170}
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler (Mark Rutland)
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180588] {CVE-2025-38319}
- drm/vc4: tests: Use return instead of assert (Maxime Ripard)
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3 (Badal Nilawar)
- drm/vmwgfx: Fix dumb buffer leak (Ian Forbes)
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource (Keisuke Nishimura)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- ALSA: core: fix up bus match const issues. (Greg Kroah-Hartman)
- ASoC: apple: mca: Constrain channels according to TDM mask (Martin Povišer)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure (AngeloGioacchino Del Regno)
- PM: sleep: Print PM debug messages during hibernation (Rafael J. Wysocki)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[] (Mingcong Bai)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- ASoC: SOF: amd: add missing acp descriptor field (Vijendar Mukunda)
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list-&gt;pipelines allocation type (Kees Cook)
- PM: EM: Fix potential division-by-zero error in em_compute_costs() (Yaxiong Tian) [Orabug: 38180521] {CVE-2025-38297}
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
- spi: tegra210-quad: remove redundant error handling code (Vishwaroop A)
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0 (Qiuxu Zhuo)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180523] {CVE-2025-38298}
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() (Julien Massot) [Orabug: 38180528] {CVE-2025-38299}
- ASoC: tas2764: Enable main IRQs (Hector Martin)
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading (Daniil Tatianin)
- crypto: api - Redo lookup on EEXIST (Herbert Xu)
- kunit: Fix wrong parameter to kunit_deactivate_static_stub() (Tzung-Bi Shih)
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture (Yongliang Gao)
- btrfs: fix invalid data space release when truncating block in NOCOW mode (Filipe Manana)
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches (Qu Wenruo)
- btrfs: scrub: update device stats when an error is detected (Qu Wenruo)
- powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Gaurav Batra)
- erofs: avoid using multiple devices with different type (Sheng Yong) [Orabug: 38153185] {CVE-2025-38172}
- erofs: fix file handle encoding for 64-bit NIDs (Hongbo Li)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153187] {CVE-2025-38173}
- kselftest: cpufreq: Get rid of double suspend in rtcwake case (Nícolas F R A Prado)
- brd: fix discard end sector (Yu Kuai)
- brd: fix aligned_sector from brd_do_discard() (Yu Kuai)
- x86/insn: Fix opcode map (!REX2) superscript tags (Masami Hiramatsu)
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ce - undo runtime PM changes during driver removal (Ovidiu Panait)
- x86/microcode/AMD: Do not return error when microcode update is not necessary (Annie Li)
- sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks (John Stultz)
- powerpc/crash: Fix non-smp kexec preparation (Eddie James)
- powerpc: do not build ppc_save_regs.o always (Jiri Slaby)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() (Ovidiu Panait) [Orabug: 38180531] {CVE-2025-38300}
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher)
- perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Sandipan Das)
- sched: Fix trace_sched_switch(.prev_state) (Peter Zijlstra)
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run() (Ovidiu Panait)
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- tools/x86/kcpuid: Fix error handling (Ahmed S. Darwish)
- uek-rpm: Set USBIP_VHCI_NR_HCS to 4 in UEK8U1 (Harshit Mogalapalli) [Orabug: 38012102]
- mptcp: disable by default (Harshvardhan Jha) [Orabug: 38035668]
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38137447,38178286] {CVE-2025-38089}
- x86/sev/docs: Document the SNP Reverse Map Table (RMP) (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add full support for a segmented RMP table (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Move the SNP probe routine out of the way (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Require the RMPREAD instruction after Zen4 (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Add support for the RMPREAD instruction (Tom Lendacky) [Orabug: 38149216]
- x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky) [Orabug: 38149216]
- rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli) [Orabug: 38158033]
- Add Zen34 clients (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- Add normal counters (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172252] {CVE-2024-36350,CVE-2024-36357}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]  
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]  
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]  
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]  
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
</package>
<package pkgid="bc86c948d24a467737385892dffbfe9c58a9adc8" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.3.el10uek]" date="1752580800">- aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
- fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
- nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
- nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
- scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
- xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
- xfs: update atomic write limits (John Garry) [Orabug: 38026089]
- xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
- xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
- xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
- xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
- xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
- xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
- xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
- xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
- xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
- xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
- xfs: rename xfs_inode_can_atomicwrite() -&gt; xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
- xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
- fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
- xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
- block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
- xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
- fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
- iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
- iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
- iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
- iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
- iomap: Rename IOMAP_ATOMIC -&gt; IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
- iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
- dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
- dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
- dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
- dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
- dm-table: atomic writes support (John Garry) [Orabug: 38026089]
- block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
- block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
- block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
- block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
- md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
- md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
- block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
- block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
- md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
- block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
- block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
- block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
- ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
- ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
- ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
- ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
- xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
- xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
- xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
- fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
- fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
- block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
- Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
- Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560} 
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500} 
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566} 
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571} 
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618} 
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
</package>
<package pkgid="dabd36b9d1533c8f62f65cc99887cc53888a48c3" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="103.40.4.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.4.el10uek]" date="1753185600">- PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
- PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
- PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
- PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
- md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
- Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
- Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
- sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-102.36.5.el10uek]" date="1753444800">- uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
- uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
- net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.1.el10uek]" date="1756814400">- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin)  [Orabug: 38361037]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.2.el10uek]" date="1757332800">- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-103.40.4.3.el10uek]" date="1758369600">- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560}
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500}
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566}
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571}
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618}
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.4.el10uek]" date="1759492800">- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton)  [Orabug: 38500610]  {CVE-2025-38724} 
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38500621]  {CVE-2025-39698} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38500629]  {CVE-2025-39881} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38500632]  {CVE-2025-39866}</changelog>
</package>
<package pkgid="6d913334eabdc3c914335a6e1ca3b0a62c971385" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="104.43.4.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.36.1.el10uek]" date="1753790400">- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
</package>
<package pkgid="f5ba3ffb18b9487800a7c72ae70f6c4ef43e1580" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="104.43.4.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.2.el10uek]" date="1754395200">- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use `#[used(compiler)]` to fix build and `modpost` with Rust &gt;= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc-&gt;idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
- rust: init: allow `dead_code` warnings for Rust &gt;= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
- rxrpc: Fix bug due to prealloc collision (David Howells)
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix `vsock_proto` declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk-&gt;sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl)
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp-&gt;nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg-&gt;scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -&gt; DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req-&gt;base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event-&gt;obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
- mtk-sd: reset host-&gt;mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.3.el10uek]" date="1755086400">- enic: get max rq &amp; wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.1.el10uek]" date="1758888000">- io_uring: Hide kabi magic from user space (Sherry Yang)  [Orabug: 38478874]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.2.el10uek]" date="1759924800">- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.4.3.el10uek]" date="1761220800">- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38572958]  {CVE-2025-39698} 
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38572953]  {CVE-2025-39866} 
- kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38572951]  {CVE-2025-3988} 
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon)  [Orabug: 38572950]  {CVE-2025-39718} 
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38572948]  {CVE-2025-39964} 
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)  [Orabug: 38572947]  {CVE-2025-39963} 
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)  [Orabug: 38572946]  {CVE-2025-39965} 
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski)  [Orabug: 38572944]  {CVE-2025-39946} 
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)  [Orabug: 38572943]  {CVE-2025-39977} 
- i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38572941]  {CVE-2025-39973}</changelog>
</package>
<package pkgid="48f9eb7d713061ba3b61d30636d197645fd14ef6" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="105.51.5.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)
- media: rc: fix races with imon_disconnect() (Larshin Sergey)
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik)
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)
- i40e: add validation for ring_len param (Lukasz Czapnik)
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.1.el10uek]" date="1764590400">- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu)  [Orabug: 38712788]  {CVE-2025-40019} 
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712786]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="6346e6c7066f284a67ab9c977b57dc261ee05d04" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="105.51.5.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-103.40.4.el10uek]" date="1755691200">- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.1.el10uek]" date="1756296000">- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw-&gt;flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos-&gt;target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&amp;info-&gt;conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv-&gt;clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn-&gt;dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's-&gt;nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev-&gt;dead under idev-&gt;mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect -&gt;defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci-&gt;xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12-&gt;guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info-&gt;send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr-&gt;performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in -&gt;write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel-&gt;priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread-&gt;priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params-&gt;set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt-&gt;fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst-&gt;output (Eric Dumazet)
- net: dst: annotate data-races around dst-&gt;input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy-&gt;rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor-&gt;name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils &lt; 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-104.43.2.el10uek]" date="1757419200">- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.3.el10uek]" date="1758024000">- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-104.43.4.el10uek]" date="1758110400">- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple)  [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple)  [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple)  [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple)  [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams)  [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple)  [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple)  [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple)  [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple)  [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple)  [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple)  [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple)  [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple)  [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox (Oracle))  [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple)  [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple)  [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt)  [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple)  [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple)  [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple)  [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple)  [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi)  [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad)  [Orabug: 38226124]  
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska)  [Orabug: 38454705]  
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska)  [Orabug: 38454705]  
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska)  [Orabug: 38454705]  
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska)  [Orabug: 38454705]  
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu)  [Orabug: 38454705]  
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono)  [Orabug: 38454705]  
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono)  [Orabug: 38454705]  
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan)  [Orabug: 38454705]  
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38498945]  
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar)  [Orabug: 38526374]  
- LTS version: v6.12.51 (Jack Vogel)   
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)   
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)   
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)   
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)   
- media: rc: fix races with imon_disconnect() (Larshin Sergey)   
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)   
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)   
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)   
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)   
- crypto: sha256 - fix crash at kexec (Breno Leitao)   
- LTS version v6.12.50 (Jack Vogel)   
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)   
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)   
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)   
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)   
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)   
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)   
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)   
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)   
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs)   
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)   
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)   
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)   
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)   
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)   
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))   
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)   
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)   
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)   
- i40e: add max boundary check for VF filters (Lukasz Czapnik)   
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)   
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)   
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)   
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)   
- i40e: add validation for ring_len param (Lukasz Czapnik)   
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)   
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)   
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)   
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)   
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)   
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)   
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)   
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)   
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)   
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)   
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)   
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)   
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)   
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)   
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)   
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)   
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)   
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)   
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)   
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)   
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)   
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang)   
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)   
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)   
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)   
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)   
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)   
- wifi: virt_wifi: Fix page fault on connect (James Guan)   
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)   
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)   
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)   
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)   
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)   
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)   
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)   
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)   
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)   
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)   
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)   
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)   
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)   
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)   
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)   
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)   
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)   
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)   
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)   
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)   
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)   
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)   
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)   
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)   
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)   
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)   
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
</package>
<package pkgid="62ef42b2b1fd891093120a53c4cb9f31b9e9ac96" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="106.55.4.1.el10uek"/>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-105.43.1.el10uek]" date="1758628800">- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats &amp; fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
</package>
<package pkgid="96ac435ffa53c69490baea96fe624682c52e28ec" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="106.55.4.2.el10uek"/>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.2.el10uek]" date="1759233600">- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo &lt; hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&amp;info-&gt;post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx &amp; RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)-&gt;fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota-&gt;charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-&gt;cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size &lt;= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust &gt;= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx-&gt;in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser-&gt;buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs-&gt;Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn-&gt;n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain-&gt;nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset &gt;= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}</changelog>
  <changelog author="Harshit Mogalapalli &lt;harshit.m.mogalapalli@oracle.com&gt; [6.12.0-105.49.3.el10uek]" date="1759320000">- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.49.4.el10uek]" date="1759838400">- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page-&gt;index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.1.el10uek]" date="1764590400">- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38712798]  {CVE-2025-38678}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.2.el10uek]" date="1766145600">- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)   {CVE-2025-40271} 
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="971ed63c1e50cc7521ff4eccfba14b159dd5715c" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-105.51.5.el10uek]" date="1760443200">- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd-&gt;max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC &gt;= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p-&gt;vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi-&gt;skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -&gt; fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
</package>
<package pkgid="ce16cf204cf198772da722cd4aee5fa4140eedaa" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.51.1.el10uek]" date="1761048000">- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 &lt;=&gt; 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
</package>
<package pkgid="c45651865e85f85d7d3c58210e307239a67c0865" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="107.59.3.4.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.2.el10uek]" date="1761652800">- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb-&gt;dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst-&gt;dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head &amp; tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev-&gt;chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx-&gt;suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device-&gt;dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab-&gt;obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab-&gt;obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk-&gt;group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) &lt; sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing &lt;Vendor Command With ID&gt; messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp-&gt;window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm-&gt;debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map-&gt;m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs-&gt;enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port-&gt;phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 &amp; v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.3.el10uek]" date="1762257600">- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu)  [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha)  [Orabug: 38277777]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-106.55.4.el10uek]" date="1762862400">- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek)  [Orabug: 37844696]  {CVE-2025-22117}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.58.1.el10uek]" date="1763467200">- sched/deadline: Stop dl_server before CPU goes offline (Peter Zijlstra (Intel))  [Orabug: 38609222]
- sched/deadline: Don't count nr_running for dl_server proxy tasks (Yicong Yang)  [Orabug: 38609222]
- sched/deadline: Fix dl_server behaviour (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix dl_server_stopped() (Huacai Chen)  [Orabug: 38609222]
- sched/deadline: Fix dl_server getting stuck (Peter Zijlstra)  [Orabug: 38609222]
- sched/deadline: Fix RT task potential starvation when expiry time passed (kuyo chang)  [Orabug: 38609222]
- sched/deadline: Less agressive dl_server handling (Peter Zijlstra)  [Orabug: 38609222]
- LTS version: v6.12.58 (Jack Vogel)
- drm/amd/display: Fix black screen with HDMI outputs (Alex Hung)
- drm/amdgpu: Fix function header names in amdgpu_connectors.c (Srinivasan Shanmugam)
- drm/amdgpu: Fix unintended error log in VCN5_0_0 (Sathishkumar S)
- ACPI: SPCR: Check for table version when using precise baudrate (Punit Agrawal)
- extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
- drm/amd/display: update color on atomic commit time (Melissa Wen)
- scsi: ufs: core: Add a quirk to suppress link_startup_again (Adrian Hunter)
- scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers (Adrian Hunter)
- lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
- virtio-net: fix received length check in big packets (Bui Quang Minh)
- drm/amd/display: Fix NULL deref in debugfs odm_combine_segments (Rong Zhang)
- drm/amdgpu/smu: Handle S0ix for vangogh (Alex Deucher)
- smb: client: fix potential UAF in smb2_close_cached_fid() (Henrique Carvalho)
- smb: client: validate change notify buffer before copy (Joshua Rogers)
- x86/microcode/AMD: Add more known models to entry sign checking (Mario Limonciello (AMD))
- rtc: rx8025: fix incorrect register reference (Yuta Hayama)
- parisc: Avoid crash due to unaligned access in unwinder (Helge Deller)
- iommufd: Don't overflow during division for dirty tracking (Jason Gunthorpe)
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (Ilia Gavrilov)
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Enable mst when it's detected but yet to be initialized (Wayne Lin)
- tracing: Fix memory leaks in create_field_var() (Zilin Guan)
- net: bridge: fix MST static key usage (Nikolay Aleksandrov)
- net: bridge: fix use-after-free due to MST port state bypass (Nikolay Aleksandrov)
- lan966x: Fix sleeping in atomic context (Horatiu Vultur)
- net: dsa: microchip: Fix reserved multicast address table programming (Tristram Ha)
- net: wan: framer: pef2256: Switch to devm_mfd_add_devices() (Haotian Zhang)
- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Dragos Tatulea)
- net: ti: icssg-prueth: Fix fdb hash size configuration (Meghana Malladi)
- net/mlx5e: Fix return value in case of module EEPROM read error (Gal Pressman)
- wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup (Martin Willi)
- bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh AP)
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni)
- net: ionic: map SKB after pseudo-header checksum prep (Mohammad Heib)
- net: ionic: add dma_wmb() before ringing TX doorbell (Mohammad Heib)
- sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
- sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler)
- sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
- net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
- net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
- net: dsa: b53: fix bcm63xx RGMII port link adjustment (Jonas Gorski)
- net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
- gpiolib: fix invalid pointer access in debugfs (Bartosz Golaszewski)
- gpio: swnode: don't use the swnode's name as the key for GPIO lookup (Bartosz Golaszewski)
- net: vlan: sync VLAN features with lower device (Hangbin Liu)
- selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
- selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
- selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
- net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
- net: dsa: tag_brcm: legacy: reorganize functions (Álvaro Fernández Rojas)
- Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() (Abdun Nihaal)
- Bluetooth: hci_event: validate skb length for unknown CC opcode (Raphael Pinsonneault-Thibeault)
- riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
- riscv: stacktrace: Disable KASAN checks for non-current tasks (Chunyan Zhang)
- net: libwx: fix device bus LAN ID (Jiawen Wu)
- ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (Steven Rostedt)
- Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
- drm/mediatek: Disable AFBC support on Mediatek DRM driver (Ariel D'Alessandro)
- media: videobuf2: forbid remove_bufs when legacy fileio is active (Marek Szyprowski)
- media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
- btrfs: ensure no dirty metadata is written back for an fs with errors (Qu Wenruo)
- ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
- x86: uaccess: don't use runtime-const rewriting in modules (Linus Torvalds)
- x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro (Kirill A. Shutemov)
- x86: use cmov for user address masking (Linus Torvalds)
- ceph: fix multifs mds auth caps issue (Kotresh HR)
- ceph: refactor wake_up_bit() pattern of calling (Viacheslav Dubeyko)
- ceph: fix potential race condition in ceph_ioctl_lazyio() (Viacheslav Dubeyko)
- ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
- drm/amdkfd: Fix mmap write lock not release (Philip Yang)
- ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
- kbuild: uapi: Strip comments before size type check (Geert Uytterhoeven)
- net: wwan: t7xx: add support for HP DRMR-H01 (Sammy Hsu)
- rtc: pcf2127: fix watchdog interrupt mask on pcf2131 (Bruno Thomsen)
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese)
- tools: lib: thermal: use pkg-config to locate libnl3 (Sascha Hauer)
- tools: lib: thermal: don't preserve owner in install (Emil Dahl Juhl)
- tools bitmap: Add missing asm-generic/bitsperlong.h include (Ian Rogers)
- LoongArch: Handle new atomic instructions for probes (Tiezhu Yang)
- ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
- scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS (Hoyoung Seo)
- 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
- cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
- 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
- NTB: epf: Allow arbitrary BAR mapping (Jerome Brunet)
- clk: clocking-wizard: Fix output clock register offset for Versal platforms (Shubhrajyoti Datta)
- clk: scmi: Add duty cycle ops only when duty cycle is supported (Jacky Bai)
- clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
- 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN (Oleg Nesterov)
- clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register (Nicolas Ferre)
- clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
- clk: at91: sam9x7: Add peripheral clock id for pmecc (Balamanikandan Gunasundar)
- ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
- rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
- clk: sunxi-ng: sun6i-rtc: Add A523 specifics (Chen-Yu Tsai)
- um: Fix help message for ssl-non-raw (Tiwei Bie)
- fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
- clk: qcom: gcc-ipq6018: rework nss_port5 clock to multiple conf (Marko Mäkelä)
- btrfs: mark dirty extent range for out of bound prealloc extents (austinchang)
- btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation (Shardul Bankar)
- RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
- RDMA/hns: Fix the modification of max_send_sge (wenglianfa)
- RDMA/hns: Fix recv CQ and QP cache affinity (Chengchang Tang)
- RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
- RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
- RDMA/irdma: Fix SD index calculation (Jacob Moroni)
- ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
- drm/amd/display: Add fallback path for YCBCR422 (Mario Limonciello)
- char: misc: restrict the dynamic range to exclude reserved minors (Thadeu Lima de Souza Cascardo)
- usb: xhci-pci: Fix USB2-only root hub registration (Michal Pecio)
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Coiby Xu)
- smb: client: transport: avoid reconnects triggered by pending task work (Fiona Ebner)
- ksmbd: use sock_create_kern interface to create kernel socket (Namjae Jeon)
- ftrace: Fix softlockup in ftrace_module_enable (Vladimir Riabchun)
- orangefs: fix xattr related buffer overflow... (Mike Marshall)
- page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
- 6pack: drop redundant locking and refcounting (Qingfang Deng)
- exfat: validate cluster allocation bits of the allocation bitmap (Namjae Jeon)
- exfat: limit log print for IO error (Chi Zhiling)
- net: stmmac: est: Drop frames causing HLBS error (Rohan G Thomas)
- ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
- Bluetooth: bcsp: receive data only if registered (Ivan Pravdin)
- Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 (Chris Lu)
- Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz)
- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (Arkadiusz Bokowy)
- net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
- net/mlx5e: Don't query FEC statistics when FEC is disabled (Carolina Jubran)
- vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices (Timothy Pearson)
- ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
- ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Primoz Fiser)
- ASoC: stm32: sai: manage context in set_sysclk callback (Olivier Moysan)
- amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw (Yifan Zhang)
- ext4: increase IO priority of fastcommit (Julian Sun)
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (chuguangqing)
- accel/habanalabs: support mapping cb with vmalloc-backed coherent memory (Moti Haimovski)
- accel/habanalabs/gaudi2: read preboot status after recovering from dirty state (Konstantin Sinyuk)
- accel/habanalabs: return ENOMEM if less than requested pages were pinned (Tomer Tayar)
- scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate (Ranjan Kumar)
- accel/habanalabs/gaudi2: fix BMON disable configuration (Vered Yavniely)
- scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
- net: bridge: Install FDB for bridge MAC on VLAN 0 (Petr Machata)
- nfs4_setup_readdir(): insufficient locking for -&gt;d_parent-&gt;d_inode dereferencing (Al Viro)
- NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
- drm/amd/display: change dc stream color settings only in atomic commit (Melissa Wen)
- drm/amd/display: Fix for test crash due to power gating (Sridevi Arvindekar)
- drm/amd/display: Init dispclk from bootup clock for DCN314 (Lo-an Chen)
- drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream (Karthi Kandasamy)
- net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 (Bastien Curutchet)
- wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 (Nithyanantham Paramasivam)
- remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
- selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt (David Yang)
- PCI/PM: Skip resuming to D0 if device is disconnected (Mario Limonciello)
- crypto: hisilicon/qm - clear all VF configurations in the hardware (Weili Qian)
- crypto: hisilicon/qm - invalidate queues in use (Weili Qian)
- vfio: return -ENOTTY for unsupported device feature (Alex Mastro)
- sparc64: fix prototypes of reads[bwl]() (Al Viro)
- sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
- PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
- r8169: set EEE speed down ratio to 1 (ChunHao Lin)
- net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
- wifi: mac80211: Track NAN interface start/stop (Ilan Peer)
- wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
- iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
- bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state (Vivek Pernamitta)
- net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
- net: phy: clear link parameters on admin link down (Oleksij Rempel)
- ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Alexey Klimov)
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (Guangshuo Li)
- jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
- jfs: Verify inode mode when loading from disk (Tetsuo Handa)
- IB/ipoib: Ignore L3 master device (Vlad Dumitrescu)
- RDMA/irdma: Update Kconfig (Tatyana Nikolova)
- ipv6: np-&gt;rxpmtu race annotation (Eric Dumazet)
- usb: xhci-pci: add support for hosts with zero USB3 ports (Niklas Neronin)
- wifi: rtw89: renew a completion for each H2C command waiting C2H event (Zong-Zhe Yang)
- wifi: rtw89: obtain RX path from ppdu status IE00 (Chih-Kang Chang)
- f2fs: fix infinite loop in __insert_extent_tree() (wangzijie)
- usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
- usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
- allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (Justin Tee)
- scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (Justin Tee)
- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (Justin Tee)
- scsi: ufs: core: Disable timestamp functionality if not supported (Bart Van Assche)
- selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
- drm/amdgpu: reject gang submissions under SRIOV (Christian König)
- drm/xe/guc: Return an error code if the GuC load fails (John Harrison)
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (Mario Limonciello (AMD))
- ethernet: Extend device_get_mac_address() to use NVMEM (Stefan Wahren)
- page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski)
- drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START (Xi Ruoyao)
- drm/amd/display: Disable VRR on DCE 6 (Timur Kristóf)
- drm/amd/display: Fix DVI-D/HDMI adapters (Timur Kristóf)
- drm/amd: Avoid evicting resources at S5 (Mario Limonciello (AMD))
- drm/amd/display: fix dml ms order of operations (Ausef Yousof)
- drm/amd/display: Set up pixel encoding for YCBCR422 (Mario Limonciello)
- drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
- wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error (Felix Fietkau)
- ALSA: serial-generic: remove shared static buffer (John Keeping)
- wifi: mt76: mt76_eeprom_override to int (Rosen Penev)
- wifi: mt76: mt7996: Temporarily disable EPCS (Benjamin Lin)
- wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device (Quan Zhou)
- net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
- crypto: caam - double the entropy delay interval for retry (Gaurav Jain)
- crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() (Yunseong Kim)
- PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() (Niklas Cassel)
- crypto: sun8i-ce - remove channel timeout field (Ovidiu Panait)
- watchdog: s3c2410_wdt: Fix max_timeout being calculated larger (Sangwook Shin)
- HID: asus: add Z13 folio to generic group for multitouch to work (Antheas Kapenekakis)
- udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari)
- net: devmem: expose tcp_recvmsg_locked errors (Stanislav Fomichev)
- selftests: Replace sleep with slowwait (David Ahern)
- eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
- selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
- x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li RongQing)
- netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
- openrisc: Add R_OR1K_32_PCREL relocation type module support (chenmiao)
- selftests: traceroute: Return correct value on failure (Ido Schimmel)
- selftests: traceroute: Use require_command() (Ido Schimmel)
- media: redrat3: use int type to store negative error codes (Qianfeng Rong)
- selftests: net: replace sleeps in fcnal-test with waits (Jakub Kicinski)
- net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
- drm/msm/registers: Generate _HI/LO builders for reg64 (Rob Clark)
- phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
- phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet (Michael Dege)
- Fix access to video_is_primary_device() when compiled without CONFIG_VIDEO (Mario Limonciello (AMD))
- phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
- wifi: mac80211: Fix HE capabilities element check (Ilan Peer)
- ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
- scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes (Peter Wang)
- scsi: ufs: host: mediatek: Correct system PM flow (Peter Wang)
- net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
- scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure (Peter Wang)
- scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue (Peter Wang)
- scsi: ufs: host: mediatek: Enhance recovery on resume failure (Peter Wang)
- selftests: mptcp: join: allow more time to send ADD_ADDR (Matthieu Baerts (NGI0))
- f2fs: fix wrong layout information on 16KB page (Jaegeuk Kim)
- media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer (Vladimir Zapolskiy)
- media: ov08x40: Fix the horizontal flip control (Hao Yao)
- wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list (Nidhish A N)
- PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs (Marek Vasut)
- char: Use list_del_init() in misc_deregister() to reinitialize list pointer (Xion Wang)
- drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
- tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() (Zizhi Wo)
- usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
- usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
- net: dsa: felix: support phy-mode = "10g-qxgmii" (Vladimir Oltean)
- drm/amd/display: Fix pbn_div Calculation Error (Fangzhi Zuo)
- drm/amdgpu: add support for cyan skillfish gpu_info (Alex Deucher)
- drm/amdgpu: don't enable SMU on cyan skillfish (Alex Deucher)
- drm/amd: add more cyan skillfish PCI ids (Alex Deucher)
- iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs (Hector Martin)
- crypto: ccp: Skip SEV and SNP INIT for kdump boot (Ashish Kalra)
- iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
- smsc911x: add second read of EEPROM mac when possible corruption seen (Colin Foster)
- net: call cond_resched() less often in __release_sock() (Eric Dumazet)
- drm/xe/guc: Set upper limit of H2G retries over CTB (Michal Wajdeczko)
- PCI: imx6: Enable the Vaux supply if available (Richard Zhu)
- ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia PukNgae)
- wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands (Ramya Gnanasekar)
- media: verisilicon: Explicitly disable selection api ioctls for decoders (Paul Kocialkowski)
- media: adv7180: Only validate format in querystd (Niklas Söderlund)
- media: adv7180: Do not write format to device in set_fmt (Niklas Söderlund)
- media: adv7180: Add missing lock in suspend callback (Niklas Söderlund)
- net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
- drm: panel-backlight-quirks: Make EDID match optional (Antheas Kapenekakis)
- drm/panthor: check bo offset alignment in vm bind (Chia-I Wu)
- ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
- selftests: drv-net: rss_ctx: make the test pass with few queues (Jakub Kicinski)
- drm/xe/guc: Increase GuC crash dump buffer size (Zhanjun Dong)
- drm/amdgpu: Allow kfd CRIU with no buffer objects (David Francis)
- drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
- dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
- dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
- dmaengine: sh: setup_xref error handling (Thomas Andreatta)
- ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
- scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend (Bharat Uppal)
- scsi: pm8001: Use int instead of u32 to store error codes (Qianfeng Rong)
- crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() (Qianfeng Rong)
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (Eric Dumazet)
- microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl support (Parthiban Veerasooran)
- inet_diag: annotate data-races in inet_diag_bc_sk() (Eric Dumazet)
- mips: lantiq: danube: rename stp node on EASY50712 reference board (Aleksander Jan Bajkowski)
- mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add model to EASY50712 dts (Aleksander Jan Bajkowski)
- mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
- drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) (Timur Kristóf)
- drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest (Mangesh Gadre)
- drm/amd/display: incorrect conditions for failing dto calculations (Clay King)
- drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting (Relja Vojvodic)
- ASoC: SOF: ipc4-pcm: Add fixup for channels (Peter Ujfalusi)
- media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS (Martin Tůma)
- media: fix uninitialized symbol warnings (Chelsy Ratnawat)
- selftests: drv-net: rss_ctx: fix the queue count check (Jakub Kicinski)
- platform/x86/intel-uncore-freq: Fix warning in partitioned system (Srinivas Pandruvada)
- drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
- drm/amd/display: Support HW cursor 180 rot for any number of pipe splits (Ivan Lipski)
- drm/amdkfd: fix vram allocation failure for a special case (Eric Huang)
- drm/amdgpu: Correct the counts of nr_banks and nr_errors (Ce Sun)
- fuse: zero initialize inode private data (Miklos Szeredi)
- net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Heiner Kallweit)
- remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper (Andrew Davis)
- extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
- scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
- scsi: mpi3mr: Fix I/O failures during controller reset (Chandrakanth Patil)
- net: ipv4: allow directed broadcast routes to use dst hint (Oscar Maes)
- rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table (Andrew Davis)
- media: ipu6: isys: Set embedded data type correctly for metadata formats (Sakari Ailus)
- net: wangxun: limit tx_max_coalesced_frames_irq (Jiawen Wu)
- idpf: do not linearize big TSO packets (Eric Dumazet)
- ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
- tty: serial: Modify the use of dev_err_probe() (Xichao Zhao)
- bnxt_en: Add Hyper-V VF ID (Pavan Chebbi)
- PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
- f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
- net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
- net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel)
- net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
- char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
- char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor (Zijun Hu)
- dm error: mark as DM_TARGET_PASSES_INTEGRITY (Christoph Hellwig)
- wifi: rtw89: fix BSSID comparison for non-transmitted BSSID (Kuan-Chung Chen)
- wifi: rtw89: wow: remove notify during WoWLAN net-detect (Kuan-Chung Chen)
- usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (raub camaioni)
- iio: adc: imx93_adc: load calibrated values even calibration failed (Haibo Chen)
- iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
- drm/amdkfd: Handle lack of READ permissions in SVM mapping (Kent Russell)
- drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou)
- drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
- HID: pidff: PERMISSIVE_CONTROL quirk autodetection (Tomasz Pakuła)
- HID: pidff: Use direction fix only for conditional effects (Tomasz Pakuła)
- drm/panthor: Serialize GPU cache flush operations (Karunika Choo)
- media: imon: make send_packet() more robust (Tetsuo Handa)
- net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas)
- scsi: ufs: host: mediatek: Fix invalid access in vccqx handling (Alice Chao)
- scsi: ufs: host: mediatek: Change reset sequence for improved stability (Peter Wang)
- scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change (Alice Chao)
- scsi: ufs: host: mediatek: Fix PWM mode switch issue (Peter Wang)
- scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration (Peter Wang)
- bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
- s390/pci: Use pci_uevent_ers() in PCI recovery (Niklas Schnelle)
- powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
- tty: serial: ip22zilog: Use platform device for probing (Thomas Bogendoerfer)
- thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- ice: Don't use %pK through printk or tracepoints (Thomas Weißschuh)
- net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
- x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
- PCI/ERR: Update device error_state already after reset (Lukas Wunner)
- media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR (Mehdi Djait)
- drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
- drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST (Tomi Valkeinen)
- drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value (Tomi Valkeinen)
- drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
- media: amphion: Delete v4l2_fh synchronously in .release() (Laurent Pinchart)
- media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
- drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey McRae)
- wifi: rtw88: sdio: use indirect IO for device registers before power-on (Ping-Ke Shih)
- wifi: rtw89: print just once for unknown C2H events (Ping-Ke Shih)
- selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
- selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
- PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
- drm/amd/display: Wait until OTG enable state is cleared (TungYu Lu)
- drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off (Danny Wang)
- ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks (Terry Cheong)
- drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
- drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
- drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
- drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
- drm/amd/display: update dpp/disp clock from smu clock table (Paul Hsieh)
- drm/amd/display: add more cyan skillfish devices (Alex Deucher)
- drm/amdgpu: Skip poison aca bank from UE channel (Xiang Liu)
- drm/amd/amdgpu: Release xcp drm memory after unplug (Meng Li)
- drm/amdgpu: Avoid rma causes GPU duplicate reset (Ce Sun)
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. (Maarten Lankhorst)
- drm/xe/guc: Add more GuC load error status codes (John Harrison)
- drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration (Michael Strauss)
- drm/amd/display: Move setup_stream_attribute (Michael Strauss)
- drm/amdgpu: Check vcn sram load return value (Sathishkumar S)
- drm/amdgpu: add range check for RAS bad page address (Tao Zhou)
- drm/amd/display: ensure committing streams is seamless (Clay King)
- drm/amd/display: fix condition for setting timing_adjust_pending (Aurabindo Pillai)
- mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs (Ilpo Järvinen)
- mfd: core: Increment of_node's refcount before linking it to the platform device (Bastien Curutchet)
- mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
- mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
- mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
- mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
- tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
- tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
- tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
- selftests/bpf: Fix flaky bpf_cookie selftest (Mykyta Yatsenko)
- tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
- hwmon: (dell-smm) Remove Dell Precision 490 custom config data (Armin Wolf)
- hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex (Ben Copeland)
- uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
- nvme: Use non zero KATO for persistent discovery connections (Alistair Francis)
- bpf: Clear pfmemalloc flag when freeing all fragments (Amery Hung)
- riscv: bpf: Fix uninitialized symbol 'retval_off' (Chenghao Duan)
- blk-cgroup: fix possible deadlock while configuring policy (Yu Kuai)
- clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts (Markus Stockhausen)
- clocksource/drivers/timer-rtl-otto: Work around dying timers (Markus Stockhausen)
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
- ACPI: SPCR: Support Precise Baud Rate field (Chen Pei)
- spi: rpc-if: Add resume support for RZ/G3E (Biju Das)
- selftests/bpf: Fix selftest verifier_arena_large failure (Yonghong Song)
- futex: Don't leak robust_list pointer on exec race (Pranav Tyagi)
- cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
- bpftool: Fix -Wuninitialized-const-pointer warnings with clang &gt;= 21 (Tom Stellard)
- power: supply: qcom_battmgr: handle charging state change notifications (Fenglin Wu)
- pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" (Janne Grunau)
- tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
- video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
- i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C (Jarkko Nikula)
- bpf: Do not limit bpf_cgroup_from_id to current's namespace (Kumar Kartikeya Dwivedi)
- nvme-fc: use lock accessing port_state and rport state (Daniel Wagner)
- nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner)
- tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
- ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
- pwm: pca9685: Use bulk write to atomicially update registers (Uwe Kleine-König)
- mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
- firmware: qcom: tzmem: disable sc7180 platform (Nikita Travkin)
- ARM: tegra: transformer-20: fix audio-codec interrupt (Svyatoslav Ryhel)
- ARM: tegra: transformer-20: add missing magnetometer interrupt (Svyatoslav Ryhel)
- ARM: tegra: p880: set correct touchscreen clipping (Jonas Schwöbel)
- soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups (Svyatoslav Ryhel)
- arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 (Radhey Shyam Pandey)
- arm64: zynqmp: Disable coresight by default (Quanyang Wang)
- cpufreq: ondemand: Update the efficient idle check for Intel extended Families (Sohil Mehta)
- irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller (Ming Wang)
- hwmon: sy7636a: add alias (Andreas Kemnade)
- power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
- pinctrl: keembay: release allocated memory in detach path (Bartosz Golaszewski)
- hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
- hwmon: (lenovo-ec-sensors) Update P8 supprt (David Ober)
- hwmon: (k10temp) Add device ID for Strix Halo (Rong Zhang)
- hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models (Avadhut Naik)
- power: supply: qcom_battmgr: add OOI chemistry (Christopher Ruehl)
- thermal: intel: selftests: workload_hint: Mask unsupported types (Srinivas Pandruvada)
- thermal: gov_step_wise: Allow cooling level to be reduced earlier (Rafael J. Wysocki)
- ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
- ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)
- ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang song (Lenovo))
- irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
- selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh (Ricardo B. Marlière)
- arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
- cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
- selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
- libbpf: Fix USDT SIB argument handling causing unrecognized register error (Jiawei Zhao)
- ACPI: video: force native for Lenovo 82K8 (Mario Limonciello (AMD))
- ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object (Kaushlendra Kumar)
- io_uring/zctx: check chained notif contexts (Pavel Begunkov)
- irqchip/sifive-plic: Respect mask state when setting affinity (Inochi Amaoto)
- firewire: ohci: move self_id_complete tracepoint after validating register (Takashi Sakamoto)
- bpf: Use tnums for JEQ/JNE is_branch_taken logic (Paul Chaignon)
- cpufreq: ti: Add support for AM62D2 (Paresh Bhagat)
- memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
- mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
- pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
- bpf: Don't use %pK through printk (Thomas Weißschuh)
- soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
- spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
- soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
- firmware: qcom: scm: preserve assign_mem() error return value (Mukesh Ojha)
- soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Heiko Carstens)
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Gerd Bayer)
- drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
- drm/sched: Re-group and rename the entity run-queue lock (Tvrtko Ursulin)
- drm/sched: Optimise drm_sched_entity_push_job (Tvrtko Ursulin)
- usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
- x86/CPU/AMD: Add RDSEED fix for Zen5 (Gregory Price)
- mfd: kempld: Switch back to earlier -&gt;init() behavior (Heijligen, Thomas)
- cpuidle: governors: menu: Select polling state in some more cases (Rafael J. Wysocki)
- cpuidle: governors: menu: Rearrange main loop in menu_select() (Rafael J. Wysocki)
- sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU (Tejun Heo)
- ACPI: fan: Use platform device for devres-related actions (Armin Wolf)
- ACPI: fan: Add fan speed reporting for fans with only _FST (Joshua Grisham)
- drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Ivan Lipski)
- drm/amd: Check that VPE has reached DPM0 in idle handler (Mario Limonciello)
- drm/ast: Clear preserved bits from register output value (Thomas Zimmermann)
- drm/mediatek: Fix device use-after-free on unbind (Johan Hovold)
- drm/nouveau: Fix race in nouveau_sched_fini() (Philipp Stanner)
- drm/sched: avoid killing parent entity on child SIGKILL (David Rosca)
- drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann)
- drm/xe: Do not wake device during a GT reset (Matthew Brost)
- s390/mm: Fix memory leak in add_marker() when kvrealloc() fails (Miaoqian Lin)
- regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
- perf/x86/intel: Fix KASAN global-out-of-bounds warning (Dapeng Mi)
- block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
- ACPI: fan: Use ACPI handle when retrieving _FST (Armin Wolf)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
- drm/radeon: Remove calls to drm_put_dev() (Daniel Palmer)
- drm/radeon: Do not kfree() devres managed rdev (Daniel Palmer)
- ASoC: fsl_sai: Fix sync error in consumer mode (Maarten Zanders)
- dpll: spec: add missing module-name and clock-id to pin-get reply (Petr Oros)
- sfc: fix potential memory leak in efx_mae_process_mport() (Abdun Nihaal)
- net: hns3: return error code when function fails (Jijie Shao)
- tools: ynl: fix string attribute length to include null terminator (Petr Oros)
- drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
- Bluetooth: hci_core: Fix tracking of periodic advertisement (Luiz Augusto von Dentz)
- Bluetooth: ISO: Fix another instance of dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 (Luiz Augusto von Dentz)
- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (Chris Lu)
- Bluetooth: ISO: Fix BIS connection dst_type handling (Luiz Augusto von Dentz)
- Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave (Iulia Tanasescu)
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (Cen Zhang)
- usbnet: Prevents free active kevent (Lizhi Xu)
- libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
- ASoC: fsl_sai: fix bit order for DSD format (Shengjiu Wang)
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Cezary Rojewski)
- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Cezary Rojewski)
- crypto: aspeed - fix double free caused by devm (Haotian Zhang)
- bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- bpf, x86: Avoid repeated usage of bpf_prog-&gt;aux-&gt;stack_depth (Yonghong Song)
- bpf: Find eligible subprogs for private stack support (Yonghong Song)
- scsi: ufs: core: Initialize value of an attribute returned by uic cmd (Wonkon Kim)
- bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal)
- kunit: test_dev_action: Correctly cast 'priv' pointer to long* (Florian Schmaus)
- wifi: mac80211: fix key tailroom accounting leak (Johannes Berg)
- wifi: mac80211: don't mark keys for inactive links as uploaded (Miri Korenblit)
- ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Richard Fitzgerald)
- ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
- drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
- wifi: ath11k: avoid bit operation on key flags (Rameshkumar Sundaram)
- wifi: ath11k: add support for MU EDCA (Yu Zhang(Yuriy))
- wifi: ath12k: free skb during idr cleanup callback (Karthik M)
- wifi: ath11k: Add missing platform IDs for quirk table (Mark Pearson)
- wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
- x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae)
- smb: client: fix potential cfid UAF in smb2_query_info_compound (Henrique Carvalho)
- s390/pci: Restore IRQ unconditionally for the zPCI device (Farhan Ali)
- ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
- mptcp: restore window probe (Paolo Abeni)
- mptcp: drop bogus optimization in __mptcp_check_push() (Paolo Abeni)
- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
- fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar)
- Bluetooth: rfcomm: fix modem control handling (Johan Hovold)
- fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao)
- virtio-net: drop the multi-buffer XDP packet in zerocopy (Bui Quang Minh)
- ACPI: button: Call input_free_device() on failing input device registration (Kaushlendra Kumar)
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang)
- fbdev: atyfb: Check if pll_ops-&gt;init_pll failed (Daniel Palmer)
- fbcon: Set fb_display[i]-&gt;mode to NULL when the mode is released (Quanmin Yan)
- net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
- NFSD: Fix crash in nfsd4_read_release() (Chuck Lever)
- LTS version: v6.12.57 (Jack Vogel)
- btrfs: tree-checker: fix bounds check in check_inode_extref() (Dan Carpenter)
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree)
- udmabuf: fix a buf size overflow issue during udmabuf creation (Xiaogang Chen)
- wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (Aditya Kumar Singh)
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (Kees Bakker)
- gpio: idio-16: Define fixed direction of the GPIO lines (William Breathitt Gray)
- gpio: regmap: add the .fixed_direction_output configuration parameter (Ioana Ciornei)
- gpio: regmap: Allow to allocate regmap-irq device (Mathieu Dubois-Briand)
- bits: introduce fixed-type GENMASK_U*() (Vincent Mailhol)
- bits: add comments and newlines to #if, #else and #endif directives (Vincent Mailhol)
- bonding: check xdp prog when set bond mode (Wang Liang)
- bonding: return detailed error when loading native XDP fails (Hangbin Liu)
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (Alexander Wetzel)
- f2fs: fix to avoid panic once fallocation fails for pinfile (Chao Yu)
- mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: disable add_addr retrans in endpoint_tests (Geliang Tang)
- docs: kdoc: handle the obsolescensce of docutils.ErrorString() (Jonathan Corbet)
- arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c (Menglong Dong)
- sched_ext: Make qmap dump operation non-destructive (Tejun Heo)
- btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
- btrfs: tree-checker: add inode extref checks (Qu Wenruo)
- btrfs: abort transaction if we fail to update inode in log replay dir fixup (Filipe Manana)
- btrfs: use level argument in log tree walk callback replay_one_buffer() (Filipe Manana)
- btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
- btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
- btrfs: zoned: refine extent allocator hint selection (Naohiro Aota)
- btrfs: zoned: return error from btrfs_zone_finish_endio() (Johannes Thumshirn)
- btrfs: abort transaction in the process_one_buffer() log tree walk callback (Filipe Manana)
- btrfs: abort transaction on specific error places when walking log tree (Filipe Manana)
- cpuset: Use new excpus for nocpu error check when enabling root partition (Chen Ridong)
- EDAC/mc_sysfs: Increase legacy channel support to 16 (Avadhut Naik)
- x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
- x86/bugs: Report correct retbleed mitigation status (David Kaplan)
- seccomp: passthrough uprobe systemcall without filtering (Jiri Olsa)
- perf: Skip user unwind if the task is a kernel thread (Josh Poimboeuf)
- perf: Have get_perf_callchain() return NULL if crosstask and user are set (Josh Poimboeuf)
- perf: Use current-&gt;flags &amp; PF_KTHREAD|PF_USER_WORKER instead of current-&gt;mm == NULL (Steven Rostedt)
- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
- audit: record fanotify event regardless of presence of rules (Richard Guy Briggs)
- net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei)
- LTS version: v6.12.56 (Jack Vogel)
- platform/x86/amd/hsmp: Ensure sock-&gt;metric_tbl_addr is non-NULL (Suma Hegde)
- ksmbd: transport_ipc: validate payload size before reading handle (Qianchang Zhao)
- xfs: always warn about deprecated mount options (Darrick J. Wong)
- devcoredump: Fix circular locking dependency with devcd-&gt;mutex. (Maarten Lankhorst)
- serial: sc16is7xx: remove useless enable of enhanced features (Hugo Villeneuve)
- serial: 8250_mtk: Enable baud clock and manage in runtime PM (Daniel Golle)
- serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
- serial: 8250_dw: handle reset control deassert error (Artem Shimko)
- dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
- tcpm: switch check for role_sw device with fw_node (Michael Grzeschik)
- most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
- most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (Junhao Xie)
- objtool/rust: add one more `noreturn` Rust function (Miguel Ojeda)
- mei: me: add wildcat lake P DID (Alexander Usyskin)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove "invalid inc weak" check (Alice Ryhl)
- x86/microcode: Fix Entrysign revision check for Zen1/Naples (Andrew Cooper)
- xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (LI Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Kiran K)
- io_uring/sqpoll: be smarter on when to update the stime usage (Jens Axboe)
- io_uring/sqpoll: switch away from getrusage() for CPU accounting (Jens Axboe)
- sched: Remove never used code in mm_cid_get() (Andy Shevchenko)
- io_uring: correct __must_hold annotation in io_install_fixed_file (Alok Tiwari)
- gpio: ljca: Fix duplicated IRQ mapping (Haotian Zhang)
- drm/panic: Fix qr_code, ensure vmargin is positive (Jocelyn Falempe)
- drm/panic: Fix drawing the logo on a small narrow screen (Jocelyn Falempe)
- nbd: override creds to kernel when calling sock_{send,recv}msg() (Ondrej Mosnacek)
- hwmon: (sht3x) Fix error handling (Guenter Roeck)
- riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() (Paul Walmsley)
- RISC-V: Don't print details of CPUs disabled in DT (Anup Patel)
- RISC-V: Define pgprot_dmacoherent() for non-coherent devices (Anup Patel)
- drm/panthor: Fix kernel panic on partial unmap of a GPU VA region (Akash Goel)
- spi: airoha: fix reading/writing of flashes with more than one plane per lun (Mikhail Kshevetskiy)
- spi: airoha: switch back to non-dma mode in the case of error (Mikhail Kshevetskiy)
- spi: airoha: do not keep {tx,rx} dma buffer always mapped (Lorenzo Bianconi)
- spi: airoha: add support of dual/quad wires spi modes to exec_op() handler (Mikhail Kshevetskiy)
- spi: airoha: return an error for continuous mode dirmap creation cases (Mikhail Kshevetskiy)
- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (Artem Shimko)
- firmware: arm_scmi: Account for failed debug initialization (Cristian Marussi)
- arm64: dts: broadcom: bcm2712: Define VGIC interrupt (Peter Robinson)
- arm64: dts: broadcom: bcm2712: Add default GIC address cells (Krzysztof Kozlowski)
- spi: spi-nxp-fspi: add extra delay after dll locked (Han Xu)
- drm/amd/display: increase max link count and fix link-&gt;enc NULL pointer access (Charlene Liu)
- mm: prevent poison consumption when splitting THP (Qiuxu Zhuo)
- selftests: mptcp: join: mark implicit tests as skipped if not supported (Matthieu Baerts (NGI0))
- selftests: mptcp: join: mark 'flush re-add' as skipped if not supported (Matthieu Baerts (NGI0))
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- net: stmmac: dwmac-rk: Fix disabling set_clock_selection (Sebastian Reichel)
- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- cifs: Fix TCP_Server_Info::credits to be signed (David Howells)
- can: netlink: can_changelink(): allow disabling of automatic restart (Marc Kleine-Budde)
- ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 (Xi Ruoyao)
- slab: Fix obj_ext mistakenly considered NULL due to race condition (Hao Ge)
- slab: Avoid race on slab-&gt;obj_exts in alloc_slab_obj_exts (Hao Ge)
- Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
- xfs: fix locking in xchk_nlinks_collect_dir (Darrick J. Wong)
- gpio: 104-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- gpio: pci-idio-16: Define maximum valid register address offset (William Breathitt Gray)
- btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() (Dewei Meng)
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
- dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC (Marek Szyprowski)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- fs/notify: call exportfs_encode_fid with s_umount (Jakub Acs)
- net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad)
- net: phy: micrel: always set shared-&gt;phydev for LAN8814 (Robert Marko)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
- ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop (Jiasheng Jiang)
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang Ying)
- net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions (Aksh Garg)
- net/smc: fix general protection fault in __smc_diag_dump (Wang Liang)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Amery Hung)
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Amery Hung)
- net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead (Carolina Jubran)
- selftests: net: fix server bind failure in sctp_vrf.sh (Xin Long)
- can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (Marc Kleine-Budde)
- dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- net: enetc: fix the deadlock of enetc_mdio_lock (Jianpeng Chang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesböck)
- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Nathan Chancellor)
- PM: EM: Fix late boot with holes in CPU topology (Christian Loehle)
- PM: EM: Move CPU capacity check to em_adjust_new_capacity() (Rafael J. Wysocki)
- PM: EM: Slightly reduce em_check_capacity_update() overhead (Rafael J. Wysocki)
- PM: EM: Drop unused parameter from em_adjust_new_capacity() (Rafael J. Wysocki)
- Unbreak 'make tools/*' for user-space targets (Linus Torvalds)
- smb: server: let smb_direct_flush_send_list() invalidate a remote key first (Stefan Metzmacher)
- s390/mm: Use __GFP_ACCOUNT for user page table allocations (Heiko Carstens)
- drivers/perf: hisi: Relax the event ID check in the framework (Yicong Yang)
- powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure (Christophe Leroy)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- gfs2: Fix unlikely race in gdlm_put_lock (Andreas Gruenbacher)
- arm64: sysreg: Correct sign definitions for EIESB and DoubleLock (Fuad Tabba)
- lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao)
- PCI: Test for bit underflow in pcie_set_readrq() (Kees Cook)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
- exec: Fix incorrect type for ret (Xichao Zhao)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.2.el10uek]" date="1764072000">- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar)  [Orabug: 38690527]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38656184]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38656184]
- xfs: fix various problems in xfs_atomic_write_cow_iomap_begin (Darrick J. Wong)  [Orabug: 38654556]
- xfs: fix delalloc write failures in software-provided atomic writes (Darrick J. Wong)  [Orabug: 38654556]
- LTS version v6.12.59 (Jack Vogel)
- Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (Pauli Virtanen)
- proc: proc_maps_open allow proc_mem_open to return NULL (Jialin Wang)
- net: netpoll: ensure skb_pool list is always initialized (John Sperbeck)
- net: phy: micrel: Fix lan8814_config_init (Horatiu Vultur)
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal)
- mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to &gt;0 order (Zi Yan)
- mm/huge_memory: do not change split_huge_page*() target order silently (Zi Yan)
- mm/secretmem: fix use-after-free race in fault handler (Lance Yang)
- mm/truncate: unmap large folio on split failure (Kiryl Shutsemau)
- mm/memory: do not populate page table entries beyond i_size (Kiryl Shutsemau)
- uio_hv_generic: Set event for all channels on the device (Long Li)
- rust: kbuild: workaround `rustdoc` doctests modifier bug (Miguel Ojeda)
- rust: kbuild: treat `build_error` and `rustdoc` as kernel objects (Miguel Ojeda)
- io_uring/napi: fix io_napi_entry RCU accesses (Olivier Langlois)
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Denis Arefev)
- KVM: VMX: Fix check for valid GVA on an EPT violation (Sukrit Bhatnagar)
- KVM: VMX: Split out guts of EPT violation to common/exposed function (Sean Christopherson)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao)
- net: netpoll: flush skb pool during cleanup (Breno Leitao)
- net: netpoll: Individualize the skb pool (Breno Leitao)
- KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (Sean Christopherson)
- KVM: guest_memfd: Remove RCU-protected attribute from slot-&gt;gmem.file (Yan Zhao)
- KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() (Sean Christopherson)
- mm, percpu: do not consider sleepable allocations atomic (Michal Hocko)
- wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work (Benjamin Berg)
- wifi: cfg80211: add an hrtimer based delayed work item (Benjamin Berg)
- mptcp: fix MSG_PEEK stream corruption (Paolo Abeni)
- selftests: mptcp: join: properly kill background tasks (Matthieu Baerts (NGI0))
- selftests: mptcp: join: userspace: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: trunc: read all recv data (Matthieu Baerts (NGI0))
- selftests: mptcp: join: endpoints: longer transfer (Matthieu Baerts (NGI0))
- selftests: mptcp: join: rm: set backup flag (Matthieu Baerts (NGI0))
- selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts (NGI0))
- pmdomain: samsung: plug potential memleak during probe (André Draszik)
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces (Vitaly Prosyak)
- drm/amdkfd: relax checks for over allocation of save area (Jonathan Kim)
- btrfs: release root after error in data_reloc_print_warning_inode() (Zilin Guan)
- btrfs: do not update last_log_commit when logging inode due to a new name (Filipe Manana)
- btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() (Zilin Guan)
- btrfs: zoned: fix conventional zone capacity calculation (Naohiro Aota)
- PM: hibernate: Use atomic64_t for compressed_size variable (Mario Limonciello (AMD))
- PM: hibernate: Emit an error when image writing fails (Mario Limonciello (AMD))
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY (Huacai Chen)
- ftrace: Fix BPF fexit with livepatch (Song Liu)
- selftests/user_events: fix type cast for write_index packed member in perf_test (Ankit Khushwaha)
- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (Borislav Petkov (AMD))
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- smb: client: fix cifs_pick_channel when channel needs reconnect (Henrique Carvalho)
- crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value (Miaoqian Lin)
- crash: fix crashkernel resource shrink (Sourabh Jain)
- codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext (Hao Ge)
- cifs: client: fix memory leak in smb3_fs_context_parse_param (Edward Adam Davis)
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai)
- mmc: dw_mmc-rockchip: Fix wrong internal phase calculate (Shawn Lin)
- mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
- mm/shmem: fix THP allocation and fallback loop (Kairui Song)
- mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang)
- wifi: mac80211: reject address change while connecting (Johannes Berg)
- selftests/tracing: Run sample events to clear page cache events (Steven Rostedt)
- nilfs2: avoid having an active sc_timer before freeing sci (Edward Adam Davis)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang)
- LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY (Tianyang Zhang)
- LoongArch: Use correct accessor to read FWPC/MWPC (Huacai Chen)
- dma-mapping: benchmark: Restore padding to ensure uABI remained consistent (Qinxin Xia)
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes)
- ksmbd: close accepted socket when per-IP limit rejects connection (Joshua Rogers)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia)
- nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes (Olga Kornievskaia)
- nfsd: fix refcount leak in nfsd_set_fh_dentry() (NeilBrown)
- KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated (Yosry Ahmed)
- LoongArch: KVM: Add delay until timer interrupt injected (Bibo Mao)
- LoongArch: KVM: Restore guest PMU if it is enabled (Bibo Mao)
- net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
- HID: uclogic: Fix potential memory leak in error path (Abdun Nihaal)
- HID: playstation: Fix memory leak in dualshock4_get_calibration_data() (Abdun Nihaal)
- ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY (Rafał Miłecki)
- HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
- ARM: dts: imx51-zii-rdu1: Fix audmux node names (Jihed Chaibi)
- arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic (Dragan Simic)
- arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 (Anand Moon)
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)
- Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" (Pablo Neira Ayuso)
- sched_ext: Fix unsafe locking in the scx_dump_state() (Zqiang)
- fs/namespace: correctly handle errors returned by grab_requested_mnt_ns (Andrei Vagin)
- virtio-fs: fix incorrect check for fsvq-&gt;kobj (Alok Tiwari)
- mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
- hostfs: Fix only passing host root in boot stage with new mount (Hongbo Li)
- f2fs: fix to avoid overflow while left shift operation (Chao Yu)
- Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin)
- lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
- ext4: introduce ITAIL helper (Ye Bin)
- proc: fix the issue of proc_mem_open returning NULL (Penglei Jiang)
- wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (Manivannan Sadhasivam)
- irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops (Nick Hu)
- bpf: account for current allocated stack depth in widen_imprecise_scalars() (Eduard Zingerman)
- bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet)
- acpi/hmat: Fix lockdep warning for hmem_register_resource() (Dave Jiang)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee)
- NFS: Fix LTP test failures when timestamps are delegated (Dai Ngo)
- NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
- NFS: sysfs: fix leak when nfs_client kobject add fails (Yang Xiuwei)
- NFSv2/v3: Fix error handling in nfs_atomic_open_v23() (Trond Myklebust)
- simplify nfs_atomic_open_v23() (Al Viro)
- pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS (Trond Myklebust)
- pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() (Trond Myklebust)
- ASoC: tas2781: fix getting the wrong device number (Shenghao Ding)
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes)
- ASoC: codecs: va-macro: fix resource leak in probe error path (Haotian Zhang)
- ASoC: cs4271: Fix regulator leak on probe failure (Haotian Zhang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Haotian Zhang)
- acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Perform fast check switch only for online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Check _CPC validity for only the online CPUs (Gautham R. Shenoy)
- ACPI: CPPC: Detect preferred core availability on online CPUs (Gautham R. Shenoy)
- hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
- virtio-net: fix incorrect flags recording in big mode (Xuan Zhuo)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net/mlx5e: Fix potentially misleading debug message (Gal Pressman)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
- net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
- net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N)
- net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
- af_unix: Initialise scc_index in unix_add_edge(). (Kuniyuki Iwashima)
- wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
- net: mdio: fix resource leak in mdiobus_register_device() (Buday Csaba)
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism (Aksh Garg)
- net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout (Aksh Garg)
- net/handshake: Fix memory leak in tls_handshake_accept() (Zilin Guan)
- net/smc: fix mismatch between CLC header and proposal (D. Wythe)
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet)
- Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
- Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
- Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault)
- Bluetooth: MGMT: cancel mesh send timer when hdev removed (Pauli Virtanen)
- NFSD: Skip close replay processing if XDR encoding fails (Chuck Lever)
- rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags (Xi Ruoyao)
- net: phy: micrel: lan8814 fix reset of the QSGMII interface (Horatiu Vultur)
- net: phy: micrel: Replace hardcoded pages with defines (Horatiu Vultur)
- net: phy: micrel: Introduce lanphy_modify_page_reg (Horatiu Vultur)
- net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
- selftests: net: local_termination: Wait for interfaces to come up (Alexander Sverdlin)
- erofs: avoid infinite loop due to incomplete zstd-compressed data (Gao Xiang)
- wifi: ath11k: zero init info-&gt;status in wmi_process_mgmt_tx_comp() (Nicolas Escande)
- ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
- HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL (Stuart Hayhurst)
- smb/server: fix possible refcount leak in smb2_sess_setup() (ZhangGuoDong)
- smb/server: fix possible memory leak in smb2_read() (ZhangGuoDong)
- exfat: fix improper check of dentry.stream.valid_size (Jaehun Gou)
- HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel (Oleg Makarenko)
- NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
- HID: nintendo: Wait longer for initial probe (Vicki Pfau)
- HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
- NFS4: Apply delay_retrans to async operations (Joshua Watt)
- NFS4: Fix state renewals missing after boot (Joshua Watt)
- drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (Jesse.Zhang)
- drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König)
- drm/amd/pm: Disable MCLK switching on SI at high pixel clocks (Timur Kristóf)
- drm/amdgpu: remove two invalid BUG_ON()s (Christian König)
- riscv: acpi: avoid errors caused by probing DT devices when ACPI is used (Han Gao)
- RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
- riscv: Build loader.bin exclusively for Canaan K210 (Feng Jiang)
- compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
- arm64: kprobes: check the return value of set_memory_rox() (Yang Shi)
- drm/xe: Do clean shutdown also when using flr (Jouni Högander)
- drm/xe: Move declarations under conditional branch (Tejas Upadhyay)
- drm/xe/guc: Synchronize Dead CT worker with unbind (Balasubramani Vivekanandan)
- drm/amd: Fix suspend failure with secure display TA (Mario Limonciello)
- iommufd: Make vfio_compat's unmap succeed if the range is already empty (Jason Gunthorpe)
- smb: client: fix refcount leak in smb2_set_path_attr (Shuhao Fu)
- drm/i915: Fix conversion between clock ticks and nanoseconds (Umesh Nerlige Ramappa)
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik)
- drm/mediatek: Add pm_runtime support for GCE power control (Jason-JH Lin)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge)  [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)  [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.1.el10uek]" date="1766059200">- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang)  [Orabug: 38781323]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.2.el10uek]" date="1766318400">- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.3.el10uek]" date="1768564800">- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38858283]  {CVE-2025-40248}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.4.el10uek]" date="1770292800">- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet)  [Orabug: 38932996]  {CVE-2025-40257} 
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38932973]  {CVE-2025-40149} 
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet)  [Orabug: 38932955]  {CVE-2025-40258} 
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38932939]</changelog>
</package>
<package pkgid="c6c4838ea2484f13671910647f385bb56181c66a" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="108.64.6.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-107.59.3.el10uek]" date="1765281600">- rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge) [Orabug: 38352483]
- dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp) [Orabug: 38643312]
- net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal) [Orabug: 38733231]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.62.1.el10uek]" date="1765886400">- uek-rpm: Allow disabling kabichk at command line (Yifei Liu) [Orabug: 38733049]
- Revert "xfrm: Use xdo.dev instead of xdo.real_dev" (Jack Vogel) [Orabug: 38718730]
- Revert "net/mlx5: Fix IPsec cleanup over MPV device" (Jack Vogel) [Orabug: 38718730]
- LTS version: v6.12.62 (Jack Vogel)
- bus: mhi: host: pci_generic: Add Telit FN990B40 modem support (Daniele Palmas)
- bus: mhi: host: pci_generic: Add Telit FN920C04 modem support (Daniele Palmas)
- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (Navaneeth K)
- staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (Navaneeth K)
- staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (Navaneeth K)
- comedi: check device's attached status in compat ioctls (Nikita Zhandarovich)
- comedi: multiq3: sanitize config options in multiq3_attach() (Nikita Zhandarovich)
- comedi: c6xdigio: Fix invalid PNP driver unregistration (Ian Abbott)
- wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 (Zenm Chen)
- wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1 (Zenm Chen)
- samples: work around glibc redefining some of our defines wrong (Linus Torvalds)
- LoongArch: Mask all interrupts during kexec/kdump (Huacai Chen)
- HID: elecom: Add support for ELECOM M-XT3URBK (018F) (Naoki Ueki)
- platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally (Antheas Kapenekakis)
- platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list (Antheas Kapenekakis)
- platform/x86: huawei-wmi: add keys for HONOR models (Ston Jia)
- HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list (April Grimoire)
- platform/x86: acer-wmi: Ignore backlight event (Armin Wolf)
- pinctrl: qcom: msm: Fix deadlock in pinmux configuration (Praveen Talari)
- nvme: fix admin request_queue lifetime (Keith Busch) [Orabug: 38773611] {CVE-2025-68265}
- HID: hid-input: Extend Elan ignore battery quirk to USB (Mario Limonciello)
- bfs: Reconstruct file type when loading from disk (Tetsuo Handa)
- ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (Lushih Hsieh)
- drm/amdkfd: Fix GPU mappings for APU after prefetch (Harish Kasiviswanathan)
- smb: fix invalid username check in smb3_fs_context_parse_param() (Yiqi Sun)
- Bluetooth: btrtl: Avoid loading the config file on security chips (Max Chou)
- drm/vmwgfx: Use kref in vmw_bo_dirty (Ian Forbes)
- spi: imx: keep dma request disabled before dma transfer setup (Robin Gong)
- spi: xilinx: increase number of retries before declaring stall (Alvaro Gamez Machado)
- ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() (Song Liu)
- USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
- serial: add support of CPCI cards (Magne Bruno)
- USB: serial: ftdi_sio: match on interface number for jtag (Johan Hovold)
- USB: serial: option: move Telit 0x10c7 composition in the right place (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FE910C04 new compositions (Fabio Porcedda)
- USB: serial: option: add Foxconn T99W760 (Slark Xiao)
- KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (Omar Sandoval) [Orabug: 38773578] {CVE-2025-68259}
- comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (Nikita Zhandarovich)
- ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (Alexey Nepomnyashih) [Orabug: 38773586] {CVE-2025-68261}
- locking/spinlock/debug: Fix data-race in do_raw_write_lock (Alexander Sverdlin)
- ksmbd: ipc: fix use-after-free in ipc_msg_send_request (Qianchang Zhao)
- ext4: refresh inline data size before write operations (Deepanshu Kartikey) [Orabug: 38773602] {CVE-2025-68264}
- jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (Ye Bin) [Orabug: 38792632] {CVE-2025-68337}
- Documentation: process: Also mention Sasha Levin as stable tree maintainer (Bagas Sanjaya)
- xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca)
- xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)
- Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca)
- xfrm: delete x-&gt;tunnel as we delete x (Sabrina Dubroca) [Orabug: 38730491,38854317] {CVE-2025-40215}
- LTS version: v6.12.61 (Jack Vogel)
- spi: spi-nxp-fspi: Check return value of devm_mutex_init() (Thomas Weißschuh)
- drm/i915/dp: Initialize the source OUI write timestamp always (Imre Deak)
- Revert "ACPI: Suppress misleading SPCR console message when SPCR table is absent" (Punit Agrawal)
- wifi: ath12k: correctly handle mcast packets for clients (Sarika Sharma)
- net: dsa: microchip: Free previously initialized ports on init failures (Bastien Curutchet)
- net: dsa: microchip: Do not execute PTP driver code for unsupported switches (Tristram Ha)
- drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (Thomas Zimmermann) [Orabug: 38773709] {CVE-2025-68296}
- net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() (Bastien Curutchet)
- KVM: SVM: Fix redundant updates of LBR MSR intercepts (Yosry Ahmed)
- KVM: nSVM: Fix and simplify LBR virtualization handling with nested (Yosry Ahmed)
- KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() (Yosry Ahmed)
- KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts() (Yosry Ahmed)
- mm/huge_memory: fix NULL pointer deference when splitting folio (Wei Yang) [Orabug: 38773700] {CVE-2025-68293}
- usb: gadget: udc: fix use-after-free in usb_gadget_state_work (Jimmy Hu) [Orabug: 38773635] {CVE-2025-68282}
- usb: udc: Add trace event for usb_gadget_set_state (Kuen-Han Tsai)
- can: rcar_canfd: Fix CAN-FD mode as default (Biju Das)
- usb: typec: ucsi: psy: Set max current to zero when disconnected (Jameson Thies)
- nfsd: Replace clamp_t in nfsd4_get_drc_mem() (Neil Brown)
- staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann)
- libceph: replace BUG_ON with bounds check for map-&gt;max_osd (Ziming Zhang) [Orabug: 38773641] {CVE-2025-68283}
- libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773648] {CVE-2025-68284}
- libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773654] {CVE-2025-68285}
- net: dsa: microchip: Don't free uninitialized ksz_irq (Bastien Curutchet)
- net: dsa: microchip: ptp: Fix checks on irq_find_mapping() (Bastien Curutchet)
- net: dsa: microchip: common: Fix checks on irq_find_mapping() (Bastien Curutchet)
- drm/amd/display: Don't change brightness for disabled connectors (Mario Limonciello)
- drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773661] {CVE-2025-68286}
- drm/amd/amdgpu: reserve vm invalidation engine for uni_mes (Michael Chen)
- drm: sti: fix device leaks at component probe (Johan Hovold)
- USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang)
- USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov)
- xhci: dbgtty: fix device unregister (Łukasz Bartosik)
- xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman)
- xhci: fix stale flag preventig URBs after link state error is cleared (Mathias Nyman)
- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar)
- usb: dwc3: pci: Sort out the Intel device IDs (Krogerus Heikki)
- usb: dwc3: pci: add support for the Intel Nova Lake -S (Krogerus Heikki)
- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792592] {CVE-2025-68331}
- usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762728] {CVE-2025-40345}
- USB: storage: Remove subclass and protocol overrides from Novatek quirk (Alan Stern)
- usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773676] {CVE-2018-1000204,CVE-2025-68288}
- usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea)
- usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai)
- usb: cdns3: Fix double resource release in cdns3_pci_probe (Miaoqian Lin)
- most: usb: fix double free on late probe failure (Johan Hovold)
- serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin)
- mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). (Kuniyuki Iwashima)
- mptcp: clear scheduled subflows on retransmit (Paolo Abeni)
- mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level (Jisheng Zhang)
- mm/memfd: fix information leak in hugetlb folios (Deepanshu Kartikey) [Orabug: 38773697] {CVE-2025-68292}
- firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli)
- nvmem: layouts: fix nvmem_layout_bus_uevent (Guan Wentao)
- slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin)
- thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski)
- smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773703] {CVE-2025-68295}
- drivers/usb/dwc3: fix PCI parent check (Jamie Iles)
- dm-verity: fix unreliable memory allocation (Mikulas Patocka)
- ceph: fix crash in process_v2_sparse_read() for encrypted directories (Viacheslav Dubeyko) [Orabug: 38773716] {CVE-2025-68297}
- can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde)
- can: sja1000: fix max irq loop handling (Thomas Mühlbacher)
- Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref (Douglas Anderson) [Orabug: 38773723] {CVE-2025-68298}
- atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han)
- ARM: dts: nxp: imx6ul: correct SAI3 interrupt line (Maarten Zanders)
- arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity (Xu Yang)
- arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos (Frank Li)
- ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (Ivan Zhaldak)
- tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (Deepanshu Kartikey) [Orabug: 38792583] {CVE-2025-68329}
- MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow (Thomas Bogendoerfer)
- MIPS: mm: Prevent a TLB shutdown on initial uniquification (Maciej W. Rozycki)
- iio: adc: rtq6056: Correct the sign bit index (Chiyuan Huang)
- iio: adc: ad7280a: fix ad7280_store_balance_timer() (David Lechner)
- iio: accel: fix ADXL355 startup race condition (Valek Andrej)
- iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792585] {CVE-2025-68330}
- iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling (Olivier Moysan)
- iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet)
- iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra)
- iio: humditiy: hdc3020: fix units for thresholds and hysteresis (Dimitri Fedrau)
- iio: humditiy: hdc3020: fix units for temperature and humidity measurement (Dimitri Fedrau)
- iio: buffer: support getting dma channel from the buffer (Nuno Sa)
- iio: buffer-dmaengine: enable .get_dma_dev() (Nuno Sa)
- iio: buffer-dma: support getting the DMA channel (Nuno Sa)
- Revert "perf/x86: Always store regs-&gt;ip in perf_callchain_kernel()" (Jiri Olsa)
- Revert "drm/amd/display: Move setup_stream_attribute" (Alex Deucher)
- spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou)
- spi: nxp-fspi: Propagate fwnode in ACPI case as well (Andy Shevchenko)
- spi: spi-nxp-fspi: Add OCT-DTR mode support (Haibo Chen)
- spi: spi-nxp-fspi: remove the goto in probe (Haibo Chen)
- spi: nxp-fspi: Support per spi-mem operation frequency switches (Miquel Raynal)
- spi: spi-mem: Add a new controller capability (Miquel Raynal)
- spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency (Miquel Raynal)
- spi: spi-mem: Allow specifying the byte order in Octal DTR mode (Tudor Ambarus)
- spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors (Xu Wang)
- spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA (Francesco Lavra)
- fs/namespace: fix reference leak in grab_requested_mnt_ns (Andrei Vagin) [Orabug: 38773950] {CVE-2025-68300}
- mailbox: pcc: don't zero error register (Jamie Iles)
- mailbox: pcc: Refactor error handling in irq handler into separate function (Sudeep Holla)
- mailbox: mtk-cmdq: Refine DMA address handling for the command buffer (Jason-JH Lin)
- mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang)
- usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors (Xu Wang)
- iio: st_lsm6dsx: Fixed calibrated timestamp calculation (Mario Tesi)
- net: fec: do not register PPS event for PEROUT (Wei Fang)
- net: fec: do not allow enabling PPS and PEROUT simultaneously (Wei Fang)
- net: fec: do not update PEROUT if it is enabled (Wei Fang)
- net: fec: cancel perout_timer when PEROUT is disabled (Wei Fang)
- net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773728] {CVE-2025-68301}
- eth: fbnic: Fix counter roll-over issue (Mohsin Bashir)
- net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean)
- net: dsa: sja1105: simplify static configuration reload (Russell King)
- net: wwan: mhi: Keep modem name match with Foxconn T99W640 (Slark Xiao)
- drm/amdgpu: fix cyan_skillfish2 gpu info fw handling (Alex Deucher)
- net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev)
- team: Move team device type change at the end of team_port_add (Nikola Z. Ivanov) [Orabug: 38796270] {CVE-2025-68340}
- net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino)
- drm/xe: Fix conversion from clock ticks to milliseconds (Harish Chegondi)
- net: lan966x: Fix the initialization of taprio (Horatiu Vultur)
- net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng)
- platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter)
- net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (Daniel Golle)
- veth: reduce XDP no_direct return section to fix race (Jesper Dangaard Brouer) [Orabug: 38796276] {CVE-2025-68341}
- veth: more robust handing of race to avoid txq getting stuck (Jesper Dangaard Brouer)
- veth: prevent NULL pointer dereference in veth_xdp_rcv (Jesper Dangaard Brouer)
- veth: apply qdisc backpressure on full ptr_ring to reduce TX drops (Jesper Dangaard Brouer)
- net: sched: generalize check for no-queue qdisc on TX queue (Jesper Dangaard Brouer)
- Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz)
- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (Edward Adam Davis) [Orabug: 38773949] {CVE-2025-68305}
- Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP (Luiz Augusto von Dentz)
- Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface (Chris Lu) [Orabug: 38773748] {CVE-2025-68306}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data (Marc Kleine-Budde) [Orabug: 38796278] {CVE-2025-68342}
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header (Marc Kleine-Budde) [Orabug: 38796285] {CVE-2025-68343}
- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (Marc Kleine-Budde) [Orabug: 38773751] {CVE-2025-68307}
- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [Orabug: 38773759] {CVE-2025-68308}
- LTS version: v6.12.60 (Jack Vogel)
- Revert "gpio: swnode: don't use the swnode's name as the key for GPIO lookup" (Charles Keepax)
- drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched (Fangzhi Zuo)
- drm/amd/display: Insert dccg log for easy debug (Charlene Liu)
- drm/amd/display: disable DPP RCG before DPP CLK enable (Charlene Liu)
- drm/amd/display: avoid reset DTBCLK at clock init (Charlene Liu)
- xfs: fix out of bounds memory read error in symlink repair (Darrick J. Wong) [Orabug: 38730602] {CVE-2025-40246}
- xfs: Replace strncpy with memcpy (Marcelo Moreira)
- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730655] {CVE-2025-40257}
- drm/i915/dp_mst: Disable Panel Replay (Imre Deak)
- maple_tree: fix tracepoint string pointers (Martin Kaiser)
- tty/vt: fix up incorrect backport to stable releases (Jari Ruusu)
- smb: client: fix incomplete backport in cfids_invalidation_worker() (Henrique Carvalho)
- drm/amdgpu: fix gpu page fault after hibernation on PF passthrough (Samuel Zhang) [Orabug: 38773445] {CVE-2025-68230}
- tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun)
- net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
- ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe)
- s390/mm: Fix __ptep_rdp() inline assembly (Heiko Carstens)
- drm/xe: Prevent BIT() overflow when handling invalid prefetch region (Shuicheng Lin)
- Revert "RDMA/irdma: Update Kconfig" (Guan Wentao)
- KVM: arm64: Make all 32bit ID registers fully writable (Marc Zyngier)
- ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai)
- kconfig/nconf: Initialize the default locale at startup (Jakub Horký)
- kconfig/mconf: Initialize the default locale at startup (Jakub Horký)
- net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit)
- blk-crypto: use BLK_STS_INVAL for alignment errors (Carlos Llamas)
- net: tls: Change async resync helpers argument (Shahar Shitrit)
- selftests: net: use BASH for bareudp testing (Po-Hsu Lin)
- x86/microcode/AMD: Limit Entrysign signature checking to known generations (Borislav Petkov)
- scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773425] {CVE-2025-68224}
- cifs: fix typo in enable_gcm_256 module parameter (Steve French)
- bcma: don't register devices disabled in OF (Rafał Miłecki)
- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730610] {CVE-2025-40248}
- cifs: fix memory leak in smb3_fs_context_parse_param error path (Shaurya Rane) [Orabug: 38773403] {CVE-2025-68219}
- LoongArch: Use UAPI types in ptrace UAPI header (Thomas Weißschuh)
- af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic(). (Kuniyuki Iwashima)
- af_unix: Cache state-&gt;msg in unix_stream_read_generic(). (Kuniyuki Iwashima)
- devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (Shay Drory) [Orabug: 38730623] {CVE-2025-40251}
- pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() (Jared Kangas)
- pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc (Jared Kangas)
- ice: fix PTP cleanup on driver removal in error path (Grzegorz Nitka) [Orabug: 38773389] {CVE-2025-68215}
- idpf: fix possible vport_config NULL pointer deref in remove (Emil Tantilov) [Orabug: 38773956] {CVE-2025-68213}
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730628] {CVE-2025-40252}
- platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang)
- selftests: net: lib: Do not overwrite error messages (Ido Schimmel)
- s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
- nvme-multipath: fix lockdep WARN due to partition scan work (Shin'Ichiro Kawasaki) [Orabug: 38773400] {CVE-2025-68218}
- tools: riscv: Fixed misalignment of CSR related definitions (Chen Pei)
- net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730647] {CVE-2025-40254}
- net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() (Pavel Zhigulin)
- net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin)
- drm/tegra: Add call to put_pid() (Prateek Agarwal) [Orabug: 38773463] {CVE-2025-68233}
- mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
- platform/x86: msi-wmi-platform: Fix typo in WMI GUID (Armin Wolf)
- platform/x86: msi-wmi-platform: Only load on MSI devices (Armin Wolf)
- pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() (Xu Wang)
- xfrm: Prevent locally generated packets from direct output in tunnel mode (Jianbo Liu)
- xfrm: Determine inner GSO type from packet inner protocol (Jianbo Liu)
- pinctrl: realtek: Select REGMAP_MMIO for RTD driver (Yu-Chun Lin)
- xfrm: set err and extack on failure to create pcpu SA (Sabrina Dubroca)
- xfrm: drop SA reference in xfrm_state_update if dir doesn't match (Sabrina Dubroca)
- drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 (Ivan Lipski)
- drm/amd/display: Fix pbn to kbps Conversion (Fangzhi Zuo)
- drm/amd/display: Move sleep into each retry for retrieve_link_cap() (Mario Limonciello)
- drm/amd/display: Increase DPCD read retries (Mario Limonciello)
- drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled (Yifan Zha)
- drm/amd: Skip power ungate during suspend for VPE (Mario Limonciello)
- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (Robert Mcclinton) [Orabug: 38773418] {CVE-2025-68223}
- drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke)
- mptcp: do not fallback when OoO is present (Paolo Abeni)
- mptcp: decouple mptcp fastclose from tcp close (Paolo Abeni)
- mptcp: avoid unneeded subflow-level drops (Paolo Abeni)
- selftests: mptcp: join: userspace: longer timeout (Matthieu Baerts)
- selftests: mptcp: join: endpoints: longer timeout (Matthieu Baerts)
- mptcp: fix premature close in case of fallback (Paolo Abeni)
- mptcp: fix duplicate reset on fastclose (Paolo Abeni)
- mptcp: fix ack generation for fallback msk (Paolo Abeni)
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730658] {CVE-2025-40258}
- LoongArch: Don't panic if no valid cache info for PCI (Huacai Chen)
- dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski)
- MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
- scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773439] {CVE-2025-68229}
- scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730661] {CVE-2025-40259}
- nvme: nvme-fc: Ensure -&gt;ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730672] {CVE-2025-40261}
- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne)
- nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot (Nam Cao) [Orabug: 38773467] {CVE-2025-68235}
- mm/mempool: fix poisoning order&gt;0 pages with HIGHMEM (Vlastimil Babka) [Orabug: 38773453] {CVE-2025-68231}
- Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
- Input: imx_sc_key - fix memory corruption on unload (Dan Carpenter)
- Input: goodix - add support for ACPI ID GDIX1003 (Hans de Goede)
- Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730679] {CVE-2025-40263}
- Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" (Diogo Ivo)
- net: dsa: microchip: lan937x: Fix RGMII delay tuning (Oleksij Rempel)
- be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730688] {CVE-2025-40264}
- ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() (Yihang Li)
- smb: client: introduce close_cached_dir_locked() (Henrique Carvalho)
- ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
- mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773434] {CVE-2025-68227}
- mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen)
- exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang)
- shmem: fix tmpfs reconfiguration (remount) when noswap is set (Mike Yuan)
- isofs: check the return value of sb_min_blocksize() in isofs_fill_super (Yongpeng Yang)
- mtdchar: fix integer overflow in read/write ioctls (Dan Carpenter) [Orabug: 38773476] {CVE-2025-68237}
- mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara)
- arm64: dts: rockchip: disable HS400 on RK3588 Tiger (Quentin Schulz)
- arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1 (Quentin Schulz)
- arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5 (Mykola Kvach)
- arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2 (Diederik de Haas)
- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
- HID: amd_sfh: Stop sensor before starting (Mario Limonciello)
- timers: Fix NULL function pointer race in timer_shutdown_sync() (Yipeng Zou) [Orabug: 38773387] {CVE-2025-68214}
- KVM: arm64: Check the untrusted offset in FF-A memory share (Sebastian Ene) [Orabug: 38730696] {CVE-2025-40266}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.2.el10uek]" date="1766491200">- LTS version: v6.12.63 (Jack Vogel)
- ASoC: codecs: nau8325: Silence uninitialized variables warnings (Krzysztof Kozlowski)
- ALSA: wavefront: Fix integer overflow in sample size validation (Junrui Luo)
- ALSA: dice: fix buffer overflow in detect_stream_formats() (Junrui Luo)
- usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required (Sven Peter)
- usb: phy: Initialize struct usb_phy list_head (Diogo Ivo)
- usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (Haotien Hsu)
- tcp_metrics: use dst_dev_net_rcu() (Eric Dumazet) [Orabug: 38592188] {CVE-2025-40075}
- net: dst: introduce dst-&gt;dev_rcu (Eric Dumazet)
- net: lan743x: Allocate rings outside ZONE_DMA (Thangaraj Samynathan)
- LoongArch: Add machine_kexec_mask_interrupts() implementation (Huacai Chen)
- ocfs2: fix memory leak in ocfs2_merge_rec_left() (Dmitry Antipov)
- irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() (Dan Carpenter)
- scsi: imm: Fix use-after-free bug caused by unfinished delayed work (Duoming Zhou) [Orabug: 38783113] {CVE-2025-68324}
- efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs (Mauro Carvalho Chehab)
- efi/cper: Adjust infopfx size to accept an extra space (Mauro Carvalho Chehab)
- efi/cper: Add a new helper function to print bitmasks (Mauro Carvalho Chehab)
- dm log-writes: Add missing set_freezable() for freezable kthread (Xu Wang)
- dm-raid: fix possible NULL dereference with undefined raid type (Alexey Simakov)
- block: return unsigned int from queue_dma_alignment (Christoph Hellwig)
- block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set-&gt;tag_list_lock (Mohamed Khalfella) [Orabug: 38818209] {CVE-2025-68756}
- ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() (Pangliyuan)
- ALSA: firewire-motu: add bounds check in put_user loop for DSP events (Junrui Luo)
- rtc: gamecube: Check the return value of ioremap() (Xu Wang)
- drm/amdkfd: Use huge page size to check split svm range alignment (Xiaogang Chen)
- ALSA: uapi: Fix typo in asound.h comment (Andres J Rosa)
- docs: hwmon: fix link to g762 devicetree binding (Kathara Sasikumar)
- cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 (David Howells)
- drm/nouveau: refactor deprecated strcpy (Madhur Kumar)
- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (Junrui Luo)
- regulator: fixed: Rely on the core freeing the enable GPIO (Mark Brown)
- drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() (Dan Carpenter)
- nvme-auth: use kvfree() for memory allocated with kvcalloc() (Israel Rukshin)
- block: fix memory leak in __blkdev_issue_zero_pages (Shaurya Rane) [Orabug: 38798772] {CVE-2025-68348}
- block: fix comment for op_is_zone_mgmt() to include RESET_ALL (Shechenglong)
- blk-mq: Abort suspend when wakeup events are pending (Cong Zhang)
- ASoC: ak5558: Disable regulator when error happens (Shengjiu Wang)
- ASoC: ak4458: Disable regulator when error happens (Shengjiu Wang)
- ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (Xu Wang)
- platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (Anton Khirnov)
- fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() (Armin Wolf)
- NFS: Fix inheritance of the block sizes when automounting (Trond Myklebust)
- Expand the type of nfs_fattr-&gt;valid (Trond Myklebust)
- NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (Trond Myklebust) [Orabug: 38818236] {CVE-2025-68764}
- Revert "nfs: ignore SB_RDONLY when mounting nfs" (Trond Myklebust)
- Revert "nfs: clear SB_RDONLY before getting superblock" (Trond Myklebust)
- Revert "nfs: ignore SB_RDONLY when remounting nfs" (Trond Myklebust)
- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (Jonathan Curley) [Orabug: 38798774] {CVE-2025-68349}
- NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state (Trond Myklebust)
- nfs/vfs: discard d_exact_alias() (Neil Brown)
- NFS: Initialise verifiers for visible dentries in nfs_atomic_open() (Trond Myklebust)
- NFS: Initialise verifiers for visible dentries in readdir and lookup (Trond Myklebust)
- fs/nls: Fix utf16 to utf8 conversion (Armin Wolf)
- NFS: Avoid changing nlink when file removes and attribute updates race (Trond Myklebust)
- f2fs: maintain one time GC mode is enabled during whole zoned GC cycle (Daeho Jeong)
- f2fs: add gc_boost_gc_greedy sysfs node (Daeho Jeong)
- f2fs: add gc_boost_gc_multiple sysfs node (Daeho Jeong)
- f2fs: introduce reserved_pin_section sysfs entry (Chao Yu)
- f2fs: sysfs: add encoding_flags entry (Chao Yu)
- f2fs: add carve_out sysfs node (Daeho Jeong)
- f2fs: fix to avoid running out of free segments (Chao Yu)
- f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages (Jaegeuk Kim)
- f2fs: keep POSIX_FADV_NOREUSE ranges (Jaegeuk Kim)
- platform/x86:intel/pmc: Update Arrow Lake telemetry GUID (Xi Pardee)
- sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out (Xupengbo)
- 9p: fix cache/debug options printing in v9fs_show_options (Eric Sandeen)
- fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (Abdun Nihaal)
- pinctrl: single: Fix incorrect type for error return variable (Xu Wang)
- perf hist: In init, ensure mem_info is put on error paths (Ian Rogers)
- perf tools: Fix split kallsyms DSO counting (Namhyung Kim)
- perf tools: Mark split kallsyms DSOs as loaded (Namhyung Kim)
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei) [Orabug: 38783136] {CVE-2025-68325}
- net: dsa: xrs700x: reject unsupported HSR configurations (Vladimir Oltean)
- net: hsr: create an API to get hsr port type (Xiaoliang Yang)
- net: hsr: Create and export hsr_get_port_ndev() (Md Danish Anwar)
- net: hsr: remove synchronize_rcu() from hsr_add_port() (Eric Dumazet)
- net: hsr: remove one synchronize_rcu() from hsr_del_port() (Eric Dumazet)
- clk: keystone: fix compile testing (Johan Hovold)
- md/raid5: fix IO hang when array is broken with IO inflight (Yu Kuai)
- remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs (Alexandru Gagniuc)
- mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (Ivan Stepchenko)
- selftests: bonding: add delay before each xvlan_over_bond connectivity check (Hangbin Liu)
- selftests: bonding: add ipvlan over bond testing (Etienne Champetier)
- net: phy: aquantia: check for NVMEM deferral (Robert Marko)
- vfio/pci: Use RCU for error/request triggers to avoid circular locking (Alex Williamson)
- spi: ch341: fix out-of-bounds memory access in ch341_transfer_one (Tianchu Chen)
- mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors (Xu Wang)
- net: stmmac: fix rx limit check in stmmac_rx_zc() (Alexey Kodanev)
- netfilter: nft_connlimit: update the count if add was skipped (Fernando Fernandez Mancera)
- netfilter: nf_conncount: rework API to use sk_buff directly (Fernando Fernandez Mancera)
- netfilter: flowtable: check for maximum number of encapsulations in bridge vlan (Pablo Neira Ayuso)
- Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" (Ilias Stamatis)
- resource: introduce is_type_match() helper and use it (Andy Shevchenko)
- resource: replace open coded resource_intersection() (Andy Shevchenko)
- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (Sparkhuang) [Orabug: 38798786] {CVE-2025-68354}
- ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend (Marek Szyprowski)
- spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND (Mikhail Kshevetskiy)
- ASoC: Intel: catpt: Fix error path in hw_params() (Cezary Rojewski)
- vdpa/pds: use %pe for ERR_PTR() in event handler registration (Alok Tiwari)
- vhost: Fix kthread worker cgroup failure handling (Mike Christie)
- vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues (Alok Tiwari)
- virtio: fix virtqueue_set_affinity() docs (Michael S. Tsirkin)
- virtio: fix grammar in virtio_queue_info docs (Michael S. Tsirkin)
- virtio: fix whitespace in virtio_config_ops (Michael S. Tsirkin)
- virtio: fix typo in virtio_device_ready() comment (Michael S. Tsirkin)
- virtio_vdpa: fix misleading return in void function (Alok Tiwari)
- of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node (Guenter Roeck)
- ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation (Yongjian Sun)
- ublk: prevent invalid access with DEBUG (Kevin Brodsky)
- ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (René Rebe)
- hwmon: sy7636a: Fix regulator_enable resource leak on error path (Xu Wang)
- drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (Dan Carpenter)
- greybus: gb-beagleplay: Fix timeout handling in bootloader functions (Xu Wang)
- firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER (Alexandre Courbot)
- ASoC: fsl_xcvr: clear the channel status control memory (Shengjiu Wang)
- gfs2: Prevent recursive memory reclaim (Andreas Gruenbacher) [Orabug: 38798793] {CVE-2025-68356}
- ASoC: nau8325: add missing build config (Jaroslav Kysela)
- ASoC: nau8325: use simple i2c probe function (Jaroslav Kysela)
- drm/panthor: Avoid adding of kernel BOs to extobj list (Akash Goel)
- RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY (Jacob Moroni)
- RDMA/irdma: Fix data race in irdma_free_pble (Krzysztof Czurylo)
- RDMA/irdma: Fix data race in irdma_sc_ccq_arm (Krzysztof Czurylo)
- iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal (Stephan Gerhold)
- backlight: lp855x: Fix lp855x.h kernel-doc warnings (Randy Dunlap)
- backlight: led-bl: Add devlink to supplier LEDs (Luca Ceresoli)
- wifi: ieee80211: correct FILS status codes (Ria Thomas)
- iomap: always run error completions in user context (Christoph Hellwig)
- iomap: factor out a iomap_dio_done helper (Christoph Hellwig)
- um: Don't rename vmap to kernel_vmap (David Gow)
- drm/nouveau: restrict the flush page to a 32-bit address (Timur Tabi)
- PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (Shawn Lin)
- btrfs: fix leaf leak in an error path in btrfs_del_items() (Filipe Manana)
- iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables (Ryan Huang)
- staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (Jianglei Nie)
- firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc (Dinh Nguyen)
- mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (Zilin Guan)
- ASoC: tas2781: correct the wrong period (Shenghao Ding)
- RDMA/bnxt_re: Pass correct flag for dma mr creation (Selvin Xavier)
- RDMA/bnxt_re: Fix the inline size for GenP7 devices (Selvin Xavier)
- erofs: limit the level of fs stacking for file-backed mounts (Gao Xiang)
- RISC-V: KVM: Fix guest page fault within HLV* instructions (Fangyu Yu)
- crypto: ccree - Correctly handle return of sg_nents_for_len (Xu Wang)
- crypto: starfive - Correctly handle return of sg_nents_for_len (Xu Wang)
- selftests/bpf: Improve reliability of test_perf_branches_no_hw() (Matt Bobrowski)
- selftests/bpf: skip test_perf_branches_hw() on unsupported platforms (Matt Bobrowski)
- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon)
- usb: dwc2: fix hang during suspend if set as peripheral (Jisheng Zhang)
- usb: dwc2: fix hang during shutdown if set as peripheral (Jisheng Zhang)
- usb: dwc2: disable platform lowlevel hw resources during shutdown (Jisheng Zhang)
- usb: chaoskey: fix locking for O_NONBLOCK (Oliver Neukum)
- ima: Handle error code returned by ima_filter_rule_match() (Zhao Yipeng) [Orabug: 38798921] {CVE-2025-68740}
- RAS: Report all ARM processor CPER information to userspace (Jason Tian)
- wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (Seungjin Bae) [Orabug: 38798814] {CVE-2025-68362}
- cpuset: Treat cpusets in attaching as populated (Chen Ridong)
- net: phy: adin1100: Fix software power-down ready condition (Alexander Dahl)
- phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits (Cristian Ciocaltea)
- phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth (Cristian Ciocaltea)
- phy: freescale: Initialize priv-&gt;lock (Xiaolei Wang)
- phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() (Christophe Jaillet)
- leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM (Fenglin Wu)
- mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
- wifi: mac80211: fix CMAC functions not handling errors (Chien Wong)
- iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb (Aashish Sharma)
- scsi: qla2xxx: Fix improper freeing of purex item (Zilin Guan) [Orabug: 38798928] {CVE-2025-68741}
- pwm: bcm2835: Make sure the channel is enabled after pwm_request() (Uwe Kleine-König)
- perf arm_spe: Fix memset subclass in operation (Leo Yan)
- perf arm-spe: Extend branch operations (Leo Yan)
- ipv6: clear RA flags when adding a static route (Fernando Fernandez Mancera)
- drm/msm/a6xx: Improve MX rail fallback in RPMH vote init (Akhil P Oommen)
- drm/msm/a6xx: Fix the gemnoc workaround (Akhil P Oommen)
- drm/msm/a6xx: Flush LRZ cache before PT switch (Akhil P Oommen)
- drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (Jay Liu)
- fs/ntfs3: Prevent memory leaks in add sub record (Edward Adam Davis)
- fs/ntfs3: out1 also needs to put mi (Edward Adam Davis)
- powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format (Ritesh Harjani)
- powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit (Ritesh Harjani)
- bpf: Fix invalid prog-&gt;stats access when update_effective_progs fails (Pu Lehui) [Orabug: 38798931] {CVE-2025-68742}
- wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (Abdun Nihaal) [Orabug: 38818221] {CVE-2025-68759}
- drm/msm/a2xx: stop over-complaining about the legacy firmware (Dmitry Baryshkov)
- block/blk-throttle: Fix throttle slice time for SSDs (Guenter Roeck)
- NFSD/blocklayout: Fix minlength check in proc_layoutget (Sergey Bashirov)
- tracefs: fix a leak in eventfs_create_events_dir() (Al Viro)
- watchdog: starfive: Fix resource leak in probe error path (Xu Wang)
- watchdog: wdat_wdt: Fix ACPI table leak in probe function (Xu Wang)
- bpf: Check skb-&gt;transport_header is set in bpf_skb_check_mtu (Martin Kafai Lau) [Orabug: 38798820] {CVE-2025-68363}
- selftests/bpf: Fix failure paths in send_signal test (Alexei Starovoitov)
- bpf: Handle return value of ftrace_set_filter_ip in register_fentry (Menglong Dong)
- ps3disk: use memcpy_{from,to}_bvec index (René Rebe)
- drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype (Dmitry Baryshkov)
- crypto: iaa - Fix incorrect return value in save_iaa_wq() (Zilin Guan)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C (Fukaumi Naoki)
- arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A (Fukaumi Naoki)
- arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A (Fukaumi Naoki)
- PCI: keystone: Exit ks_pcie_probe() for invalid mode (Siddharth Vadapalli)
- bpf: Free special fields when update [lru_,]percpu_hash maps (Leon Hwang) [Orabug: 38798936] {CVE-2025-68744}
- leds: netxbig: Fix GPIO descriptor leak in error paths (Xu Wang)
- scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls (Xu Wang)
- ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (Xu Wang)
- ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() (Dmitry Antipov) [Orabug: 38798823] {CVE-2025-68364}
- lib/vsprintf: Check pointer before dereferencing in time_and_date() (Andy Shevchenko)
- clk: renesas: r9a06g032: Fix memory leak in error path (Xu Wang)
- coresight: etm4x: Add context synchronization before enabling trace (Leo Yan)
- coresight: etm4x: Extract the trace unit controlling (Leo Yan)
- coresight: etm4x: Correct polling IDLE bit (Leo Yan)
- coresight: Change device mode to atomic type (Leo Yan)
- nbd: defer config unlock in nbd_genl_connect (Zheng Qixing) [Orabug: 38798832] {CVE-2025-68366}
- wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (Abdun Nihaal)
- macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (Long Li) [Orabug: 38798837] {CVE-2025-68367}
- powerpc/32: Fix unpaired stwcx. on interrupt exit (Christophe Leroy)
- powerpc/kdump: Fix size calculation for hot-removed memory ranges (Sourabh Jain)
- cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs (Gautham R. Shenoy)
- scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() (Bean Huo)
- drm/panthor: Fix potential memleak of vma structure (Akash Goel)
- ntfs3: init run lock for extend inode (Edward Adam Davis)
- ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties (Jihed Chaibi)
- RDMA/rtrs: server: Fix error handling in get_or_create_srv (Ma Ke)
- dt-bindings: PCI: amlogic: Fix the register name of the DBI region (Manivannan Sadhasivam)
- scsi: smartpqi: Fix device resources accessed after device removal (Mike Mcgowen) [Orabug: 38798847] {CVE-2025-68371}
- scsi: stex: Fix reboot_notifier leak in probe error path (Xu Wang)
- nbd: defer config put in recv_work (Zheng Qixing) [Orabug: 38798850] {CVE-2025-68372}
- md: fix rcu protection in md_wakeup_thread (Yun Zhou) [Orabug: 38798857] {CVE-2025-68374}
- regulator: core: disable supply if enabling main regulator fails (Gabor Juhos)
- perf/x86/intel: Correct large PEBS flag check (Dapeng Mi)
- ext4: correct the checking of quota files before moving extents (Zhang Yi)
- mfd: da9055: Fix missing regmap_del_irq_chip() in error path (Xu Wang)
- locktorture: Fix memory leak in param_set_cpumask() (Wang Liang)
- efi/libstub: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- x86/boot: Fix page table access in 5-level to 4-level paging transition (Usama Arif)
- ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible (Jihed Chaibi)
- ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels (Yegor Yefremov)
- libbpf: Fix parsing of multi-split BTF (Alan Maguire)
- spi: tegra210-quad: Fix timeout handling (Vishwaroop A) [Orabug: 38798943] {CVE-2025-68746}
- drm/panthor: Fix UAF on kernel BO VA nodes (Boris Brezillon)
- drm/panthor: Fix race with suspend during unplug (Ketil Johnsen)
- drm/panthor: Fix UAF race between device unplug and FW event processing (Ketil Johnsen)
- drm/panthor: Fix group_free_queue() for partially initialized queues (Boris Brezillon)
- drm/panthor: Handle errors returned by drm_sched_entity_init() (Boris Brezillon)
- fs/9p: Don't open remote file with APPEND mode when writeback cache is used (Tingmao Wang)
- scsi: target: Do not write NUL characters into ASCII configfs output (Bart Van Assche)
- power: supply: apm_power: only unset own apm_get_power_status (Ahelenia Ziemiańska)
- power: supply: wm831x: Check wm831x_set_bits() return value (Ivan Abramov)
- power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() (Murad Masimov)
- power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() (Ivan Abramov)
- power: supply: max17040: Check iio_read_channel_processed() return code (Ivan Abramov)
- power: supply: cw2015: Check devm_delayed_work_autocancel() return code (Ivan Abramov)
- power: supply: rt5033_charger: Fix device node reference leaks (Xu Wang)
- perf record: skip synthesize event when open evsel failed (Shuai Xue)
- perf lock contention: Load kernel map before lookup (Namhyung Kim)
- drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() (Geert Uytterhoeven)
- interconnect: debugfs: Fix incorrect error handling for NULL path (Kuan-Wei Chiu)
- arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller (Dmitry Baryshkov)
- interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS (Dmitry Baryshkov)
- wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() (Abdun Nihaal)
- i3c: master: svc: Prevent incomplete IBI transaction (Stanley Chu)
- i3c: fix refcount inconsistency in i3c_master_register (Frank Li)
- pinctrl: stm32: fix hwspinlock resource leak in probe function (Xu Wang)
- soc: qcom: smem: fix hwspinlock resource leak in probe error paths (Xu Wang)
- tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set (Benjamin Berg)
- x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() (Tengda Wu)
- task_work: Fix NMI race condition (Peter Zijlstra)
- perf/x86/intel/cstate: Remove PC3 support from LunarLake (Zhang Rui)
- bpf: Fix stackmap overflow check in __bpf_get_stackid() (Arnaud Lecomte) [Orabug: 38798864] {CVE-2025-68378}
- bpf: Refactor stack map trace depth calculation into helper function (Arnaud Lecomte)
- perf: Remove get_perf_callchain() init_nr argument (Josh Poimboeuf)
- mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove (Xu Wang)
- mtd: nand: relax ECC parameter validation check (Aryan Srivastava)
- Revert "mtd: rawnand: marvell: fix layouts" (Aryan Srivastava)
- ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties (Wolfram Sang)
- ARM: dts: renesas: gose: Remove superfluous port property (Wolfram Sang)
- RDMA/rxe: Fix null deref on srq-&gt;rq.queue after resize failure (Zhu Yanjun) [Orabug: 38798867] {CVE-2025-68379}
- sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Kuniyuki Iwashima)
- phy: mscc: Fix PTP for VSC8574 and VSC8572 (Horatiu Vultur)
- arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory (Alexander Martinz)
- arm64: dts: qcom: sm8650: set ufs as dma coherent (Neil Armstrong)
- arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider (Gergo Koteles)
- arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller (Krishna Kurapati)
- arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller (Krishna Kurapati)
- firmware: imx: scu-irq: fix OF node leak in (Peng Fan)
- arm64: dts: ti: k3-am62p: Fix memory ranges for GPU (Randolph Sapp)
- s390/ap: Don't leak debug feature files if AP instructions are not available (Heiko Carstens)
- s390/smp: Fix fallback CPU detection (Heiko Carstens)
- wifi: ath11k: fix peer HE MCS assignment (Baochen Qiang) [Orabug: 38798872] {CVE-2025-68380}
- wifi: ath11k: fix VHT MCS assignment (Baochen Qiang)
- crypto: hisilicon/qm - restore original qos values (Nieweiqiang)
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (Thorsten Blum) [Orabug: 38798874] {CVE-2025-68724}
- soc: qcom: gsbi: fix double disable caused by devm (Xu Wang)
- soc: Switch back to struct platform_driver::remove() (Uwe Kleine-König)
- clk: qcom: camcc-sm7150: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Fix PLL config of PLL2 (Luca Weiss)
- clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other (Vladimir Zapolskiy)
- uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (Li Qiang)
- PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 (Geert Uytterhoeven)
- arm64: dts: exynos: gs101: fix sysreg_apm reg property (Peter Griffin)
- perf annotate: Check return value of evsel__get_arch() properly (Tianyou Li)
- arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 (Tim Harvey)
- arm64: dts: imx8mp-venice-gw702x: remove off-board uart (Tim Harvey)
- arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl (Tim Harvey)
- arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props (Tim Harvey)
- block/mq-deadline: Switch back to a single dispatch list (Bart Van Assche)
- block/mq-deadline: Introduce dd_start_request() (Bart Van Assche)
- firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc (Randy Dunlap)
- iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (Francesco Lavra)
- inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() (Luoxuanqiang)
- inet: Avoid ehash lookup race in inet_ehash_insert() (Luoxuanqiang)
- rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() (Luoxuanqiang)
- clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets (Konrad Dybcio)
- dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets (Stephan Gerhold)
- ntfs3: Fix uninit buffer allocated by __getname() (Sidharth Seela)
- ntfs3: fix uninit memory after failed mi_read in mi_format_new (Raphael Pinsonneault-Thibeault)
- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Herbert Xu)
- irqchip/qcom-irq-combiner: Fix section mismatch (Johan Hovold)
- irqchip/starfive-jh8100: Fix section mismatch (Johan Hovold)
- irqchip/renesas-rzg2l: Fix section mismatch (Johan Hovold)
- irqchip/imx-mu-msi: Fix section mismatch (Johan Hovold)
- irqchip/irq-brcmstb-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7120-l2: Fix section mismatch (Johan Hovold)
- irqchip/irq-bcm7038-l1: Fix section mismatch (Johan Hovold)
- sched/fair: Forfeit vruntime on yield (Fernand Sieber)
- wifi: ath11k: restore register window after global reset (Baochen Qiang)
- wifi: ath10k: move recovery check logic into a new work (Kang Yang)
- wifi: ath10k: Add missing include of export.h (Jeff Johnson)
- wifi: ath10k: Avoid vdev delete timeout when firmware is already down (Loic Poulain)
- objtool: Fix weak symbol detection (Josh Poimboeuf)
- objtool: Fix standalone --hacks=jump_label (Dylan Hatch)
- HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() (Mavroudis Chatzilazaridis)
- drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() (Cyrille Pitchen)
- clk: renesas: cpg-mssr: Read back reset registers to assure values latched (Marek Vasut)
- clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register (Thierry Bultel)
- clk: renesas: Use str_on_off() helper (Geert Uytterhoeven)
- clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback (Marek Vasut)
- pinctrl: renesas: rzg2l: Fix PMC restore (Biju Das)
- USB: Fix descriptor count when handling invalid MBIM extended descriptor (Seungjin Bae)
- drm/vgem-fence: Fix potential deadlock on release (Janusz Krzysztofik) [Orabug: 38818211] {CVE-2025-68757}
- accel/ivpu: Fix DCT active percent format (Karol Wachowski)
- accel/ivpu: Make function parameter names consistent (Jacek Lawrynowicz)
- drm/panel: visionox-rm69299: Don't clear all mode flags (Guido Günther)
- accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail (Karol Wachowski)
- accel/ivpu: Prevent runtime suspend during context abort work (Andrzej Kacprowski)
- gpu: host1x: Fix race in syncpt alloc/free (Mainak Sen) [Orabug: 38798898] {CVE-2025-68732}
- smack: fix bug: setting task label silently ignores input garbage (Konstantin Andreev)
- smack: fix bug: unprivileged task can create labels (Konstantin Andreev)
- smack: fix bug: invalid label of unix socket file (Konstantin Andreev)
- smack: always "instantiate" inode in smack_inode_init_security() (Konstantin Andreev)
- smack: deduplicate xattr setting in smack_inode_init_security() (Konstantin Andreev)
- smack: fix bug: SMACK64TRANSMUTE set on non-directory (Konstantin Andreev)
- smack: deduplicate "does access rule request transmutation" (Konstantin Andreev)
- net/mlx5e: Set default burst period for TX and RX reporters (Shahar Shitrit) [Orabug: 38636804]
- devlink: Make health reporter burst period configurable (Shahar Shitrit) [Orabug: 38636804]
- devlink: Introduce burst period for health reporter (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move health reporter recovery abort logic to a separate function (Shahar Shitrit) [Orabug: 38636804]
- devlink: Move graceful period parameter to reporter ops (Shahar Shitrit) [Orabug: 38636804]
- devlink: use devlink_nl_put_u64() helper (Przemek Kitszel) [Orabug: 38636804]
- devlink: introduce devlink_nl_put_u64() (Przemek Kitszel) [Orabug: 38636804]
- Revert "net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery" (Qing Huang) [Orabug: 38636804]
- net/rds: improve conn destroy printk message (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: expand kref coverage to rds_notifier-&gt;n_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn (Sharath Srinivasan) [Orabug: 38728739]
- net/rds: rds_sendmsg must use rs_conn only when not being destroyed (Sharath Srinivasan) [Orabug: 38728742]
- Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang) [Orabug: 38766139]
- mm: list_lru: avoid using NULL list_lru_one. (Imran Khan) [Orabug: 38787957]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg)
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa)
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn)
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe)
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping)
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen)
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan)
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo) [Orabug: 38847806] {CVE-2025-68789}
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera)
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 38649136]  {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.1.el10uek]" date="1769688000">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang)  [Orabug: 38899652]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.2.el10uek]" date="1770897600">- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan)  [Orabug: 38937451]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.3.el10uek]" date="1771329600">- net/rds: Fix issue with a revert in rds_send_queue_rm (Sharath Srinivasan)  [Orabug: 38937451]</changelog>
</package>
<package pkgid="4f2950a3f1dc10d9ba3a6f594919e3d50534e729" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="109.67.6.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.63.3.el10uek]" date="1767700800">- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756944]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.4.el10uek]" date="1768305600">- fuse: fix runtime warning on truncate_folio_batch_exceptionals() (Haiyue Wang) [Orabug: 38516705] {CVE-2025-38357}
- PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597009] {CVE-2025-40034}
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() (Michael Chan) [Orabug: 38747442] {CVE-2025-40330}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38750222,38773368] {CVE-2025-68209}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753653]
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() (Gautam R A) [Orabug: 38773315] {CVE-2025-68197}
- LTS version: v6.12.64 (Jack Vogel)
- block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() (Damien Le Moal)
- iomap: allocate s_dio_done_wq for async reads as well (Christoph Hellwig) [Orabug: 38798795] {CVE-2025-68357}
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
- vfio/pci: Disable qword access to the PCI ROM bar (Kevin Tian)
- media: amphion: Remove vpu_vb_is_codecconfig (Ming Qian)
- media: amphion: Make some vpu_v4l2 functions static (Laurent Pinchart)
- media: amphion: Add a frame flush mode for decoder (Ming Qian)
- media: mediatek: vcodec: Use spinlock for context list protection lock (Chen-Yu Tsai)
- powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
- mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
- mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
- PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
- PCI: brcmstb: Set MLW based on "num-lanes" DT property if present (Jim Quinlan)
- PCI: brcmstb: Reuse pcie_cfg_data structure (Stanimir Varbanov)
- ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width (Biju Das)
- ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Srinivas Kandagatla)
- soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter (Pierre-Louis Bossart)
- block: handle zone management operations completions (Damien Le Moal)
- ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode (Biju Das)
- gve: defer interrupt enabling until NAPI registration (Ankit Garg) [Orabug: 38887626] {CVE-2025-71156}
- hrtimers: Make hrtimer_update_function() less expensive (Thomas Gleixner)
- idpf: remove obsolete stashing code (Joshua Hay)
- idpf: stop Tx if there are insufficient buffer resources (Joshua Hay)
- idpf: replace flow scheduling buffer ring with buffer pool (Joshua Hay)
- idpf: simplify and fix splitq Tx packet rollback error path (Joshua Hay)
- idpf: improve when to set RE bit logic (Joshua Hay)
- idpf: add support for Tx refillqs in flow scheduling mode (Joshua Hay)
- idpf: trigger SW interrupt when exiting wb_on_itr mode (Joshua Hay)
- idpf: add support for SW triggered interrupts (Joshua Hay)
- wifi: mt76: mt7925: add handler to hif suspend/resume event (Quan Zhou)
- wifi: mt76: mt7925: fix CLC command timeout when suspend/resume (Quan Zhou)
- wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend (Quan Zhou)
- media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio (Dave Stevenson)
- x86/microcode/AMD: Select which microcode patch to load (Borislav Petkov)
- tty: fix tty_port_tty_*hangup() kernel-doc (Jiri Slaby)
- serial: core: Fix serial device initialization (Alexander Stein)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649205] {CVE-2025-40164}
- net: use dst_dev_rcu() in sk_setup_caps() (Eric Dumazet) [Orabug: 38649240] {CVE-2025-40170}
- ipv6: adopt dst_dev() helper (Eric Dumazet)
- net: ipv6: ioam6: use consistent dst names (Justin Iurman)
- drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (Boris Brezillon)
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT (Xiao Ni) [Orabug: 37855392] {CVE-2025-40325}
- netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773355] {CVE-2025-68206}
- gpiolib: acpi: Add quirk for Dell Precision 7780 (Askar Safin)
- gpiolib: acpi: Add quirk for ASUS ProArt PX13 (Mario Limonciello)
- gpiolib: acpi: Add a quirk for Acer Nitro V15 (Mario Limonciello)
- gpiolib: acpi: Move quirks to a separate file (Andy Shevchenko)
- gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter (Andy Shevchenko)
- gpiolib: acpi: Handle deferred list via new API (Andy Shevchenko)
- gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() (Andy Shevchenko)
- f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
- f2fs: dump more information for f2fs_{enable,disable}_checkpoint() (Chao Yu)
- f2fs: add timeout in f2fs_enable_checkpoint() (Chao Yu)
- f2fs: clear SBI_POR_DOING before initing inmem curseg (Sheng Yong)
- serial: xilinx_uartps: fix rs485 delay_rts_after_send (Jakub Turek)
- serial: xilinx_uartps: Use helper function hrtimer_update_function() (Nam Cao)
- hrtimers: Introduce hrtimer_update_function() (Nam Cao)
- drm/displayid: add quirk to ignore DisplayID checksum errors (Jani Nikula)
- sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() (Tejun Heo)
- sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() (Tejun Heo)
- tpm2-sessions: Fix tpm2_read_public range checks (Jarkko Sakkinen)
- block: freeze queue when updating zone resources (Damien Le Moal)
- ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
- svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847975] {CVE-2025-71068}
- mm/ksm: fix exec/fork inheritance support for prctl (Xu Xin)
- mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
- serial: core: Restore sysfs fwnode information (Andy Shevchenko)
- serial: core: fix OF node leak (Johan Hovold)
- f2fs: fix to avoid updating compression context during writeback (Chao Yu)
- f2fs: drop inode from the donation list when the last file is closed (Jaegeuk Kim)
- f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
- f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
- xhci: dbgtty: fix device unregister: fixup (Łukasz Bartosik)
- tty: introduce and use tty_port_tty_vhangup() helper (Jiri Slaby)
- jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
- sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks (Zqiang)
- erofs: fix unexpected EIO under memory pressure (Junbeom Yeom)
- sched/eevdf: Fix min_vruntime vs avg_vruntime (Peter Zijlstra)
- btrfs: don't rewrite ret from inode_permission (Josef Bacik)
- gfs2: fix freeze error handling (Alexey Velichayshiy)
- lib/crypto: riscv/chacha: Avoid s0/fp register (Vivian Wang)
- drm/imagination: Disallow exporting of PM/FW protected objects (Alessio Belle)
- drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
- drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer (Niemiec, Krzysztof) [Orabug: 38852366] {CVE-2025-71130}
- drm/msm/dpu: Add missing NULL pointer check for pingpong interface (Nikolay Kuratov) [Orabug: 38852395] {CVE-2025-71138}
- drm/xe: Drop preempt-fences when destroying imported dma-bufs. (Thomas Hellström)
- drm/xe: Use usleep_range for accurate long-running workload timeslicing (Matthew Brost)
- drm/xe: Adjust long-running workload timeslices to reasonable values (Matthew Brost)
- drm/xe/oa: Disallow 0 OA property values (Ashutosh Dixit)
- drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table (Thomas Hellström)
- drm/mgag200: Fix big-endian support (René Rebe)
- drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848051] {CVE-2025-71083}
- drm/i915: Fix format string truncation warning (Ard Biesheuvel)
- drm/amdkfd: Trap handler support for expert scheduling mode (Jay Cornwall)
- drm/amdkfd: bump minimum vgpr size for gfx1151 (Jonathan Kim)
- drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace (Mario Limonciello)
- drm/mediatek: Fix probe device leaks (Johan Hovold)
- drm/mediatek: Fix probe memory leak (Johan Hovold)
- drm/mediatek: Fix probe resource leaks (Johan Hovold)
- drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() (Miaoqian Lin)
- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() (Sanjay Yadav)
- drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident (Jani Nikula)
- drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
- drm/buddy: Separate clear and dirty free block trees (Arunpravin Paneer Selvam)
- drm/buddy: Optimize free block management with RB tree (Arunpravin Paneer Selvam)
- drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
- drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling (Alex Deucher)
- Revert "drm/amd: Skip power ungate during suspend for VPE" (Mario Limonciello)
- net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() (Xiaolei Wang)
- net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
- net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
- nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
- LoongArch: BPF: Sign extend kfunc call arguments (Hengqi Chen)
- LoongArch: BPF: Zero-extend bpf_tail_call() index (Hengqi Chen)
- LoongArch: Refactor register restoration in ftrace_common_return (Duan Chenghao)
- fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
- e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848098] {CVE-2025-71093}
- RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848057] {CVE-2025-71084}
- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848116] {CVE-2025-71096}
- samples/ftrace: Adjust LoongArch register restore order in direct calls (Duan Chenghao)
- tools/mm/page_owner_sort: fix timestamp comparison for stable sorting (Kaushlendra Kumar)
- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (Rongrong)
- mm/page_owner: fix memory leak in page_owner_stack_fops-&gt;release() (Ran Xiaokai)
- idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
- lockd: fix vfs_test_lock() calls (Neil Brown)
- kasan: unpoison vms[area] addresses with a common tag (Maciej Wieczor-Retman)
- kasan: refactor pcpu kasan vmalloc unpoison (Maciej Wieczor-Retman)
- compiler_types.h: add "auto" as a macro for "__auto_type" (H. Peter Anvin)
- pmdomain: imx: Fix reference count leak in imx_gpc_probe() (Xu Wang)
- mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
- mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
- mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
- mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
- mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
- mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() (Seongjae Park)
- LoongArch: Use unsigned long for _end and _text (Tiezhu Yang)
- LoongArch: Use __pmd()/__pte() for swap entry conversions (Wangyuli)
- LoongArch: Fix build errors for CONFIG_RANDSTRUCT (Huacai Chen)
- LoongArch: Correct the calculation logic of thread_count (Maqiang)
- LoongArch: Add new PCI ID for pci_fixup_vgadev() (Huacai Chen)
- media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
- media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: amphion: Cancel message work before releasing the VPU core (Ming Qian)
- media: vpif_display: fix section mismatch (Johan Hovold)
- media: vpif_capture: fix section mismatch (Johan Hovold)
- media: videobuf2: Fix device reference leak in vb2_dc_alloc error path (Xu Wang)
- media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
- media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
- media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
- media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
- media: platform: mtk-mdp3: fix device leaks at probe (Johan Hovold)
- media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
- media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
- fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
- fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
- fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
- dm-bufio: align write boundary on physical block size (Mikulas Patocka)
- dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
- powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Sandipan Das)
- parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
- parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
- mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips (Miquel Raynal)
- mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips (Miquel Raynal)
- mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions (Christian Marangi)
- media: verisilicon: Fix CPU stalls on G2 bus error (Nicolas Dufresne)
- media: rc: st_rc: Fix reset control resource leak (Xu Wang)
- mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
- mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
- clk: samsung: exynos-clkout: Assign .num before accessing .hws (Nathan Chancellor) [Orabug: 38852404] {CVE-2025-71143}
- block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs (Damien Le Moal)
- leds: leds-lp50xx: Enable chip before any communication (Christian Hitz)
- leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
- leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
- leds: leds-cros_ec: Skip LEDs without color components (Thomas Weißschuh)
- powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
- powerpc, mm: Fix mprotect on book3s 32-bit (Dave Vasilevsky)
- arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator (Siddharth Vadapalli)
- PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
- fgraph: Check ftrace_pids_enabled on registration for early filtering (Shengming Hu)
- fgraph: Initialize ftrace_ops-&gt;private for function graph ops (Shengming Hu)
- HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) [Orabug: 38848082] {CVE-2025-71089}
- iommu/tegra: fix device leak on probe_device() (Johan Hovold)
- iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
- iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
- iommu/omap: fix device leaks on probe_device() (Johan Hovold)
- iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
- iommu/mediatek-v1: fix device leaks on probe() (Johan Hovold)
- iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
- iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
- iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
- iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
- iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
- iommu/amd: Fix pci_segment memleak in alloc_pci_segment() (Jinhui Guo)
- ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
- ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
- ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
- ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Srinivas Kandagatla)
- ASoC: codecs: lpass-tx-macro: fix SM6115 support (Srinivas Kandagatla)
- ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
- ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
- ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
- ASoC: codecs: wcd939x: fix regmap leak on probe failure (Johan Hovold)
- ntfs: Do not overwrite uptodate pages (Matthew Wilcox)
- selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
- blk-mq: skip CPU offline notify on unmapped hctx (Cong Zhang)
- RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
- RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
- ksmbd: Fix memory leak in get_file_all_info() (Zilin Guan)
- md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (Tuo Li) [Orabug: 38852384] {CVE-2025-71135}
- md: Fix static checker warning in analyze_sbs (Li Nan)
- RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
- RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
- RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (Tetsuo Handa) [Orabug: 38887628] {CVE-2025-71157}
- RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
- RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
- RDMA/efa: Remove possible negative shift (Michael Margolin)
- RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852378] {CVE-2025-71133}
- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Jiayuan Chen) [Orabug: 38848033] {CVE-2025-71080}
- net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
- ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848124] {CVE-2025-71097}
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848060] {CVE-2025-71085}
- net: stmmac: fix the crash issue for zero copy XDP_TX action (Wei Fang) [Orabug: 38848110] {CVE-2025-71095}
- octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
- platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing (Junrui Luo) [Orabug: 38848146] {CVE-2025-71101}
- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (Zilin Guan)
- net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
- net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848106] {CVE-2025-71094}
- kbuild: fix compilation of dtb specified on command-line without make rule (Thomas De Schampheleire)
- net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
- firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
- genalloc.h: fix htmldocs warning (Andrew Morton)
- smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852375] {CVE-2025-71132}
- selftests: net: fix "buffer overflow detected" for tap.c (Alice C. Munduruca)
- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn) [Orabug: 38887618] {CVE-2025-71154}
- amd-xgbe: reset retries and mode on RX adapt failures (Raju Rangoju)
- net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() (Vladimir Oltean)
- team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848087] {CVE-2025-71091}
- platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
- platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
- platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names (Shravan Kumar Ramani)
- ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848130] {CVE-2025-71098}
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
- net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848042] {CVE-2025-71082}
- crypto: seqiv - Do not use req-&gt;iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852369] {CVE-2025-71131}
- idpf: reduce mbx_task schedule delay to 300us (Brian Vazquez)
- iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848072] {CVE-2025-71087}
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
- wifi: mac80211: do not use old MBSSID elements (Aloka Dixit)
- wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() (Dan Carpenter)
- wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() (Morning Star) [Orabug: 38848143] {CVE-2025-71100}
- wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Ping-Ke Shih)
- fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847945] {CVE-2025-68821}
- iommu/mediatek: fix use-after-free on probe deferral (Johan Hovold)
- x86/msi: Make irq_retrigger() functional for posted MSI (Thomas Gleixner)
- ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 (Nicolas Ferre)
- hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
- hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852299] {CVE-2025-71111}
- hwmon: (max6697) fix regmap leak on probe failure (Johan Hovold)
- hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
- interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes (Raviteja Laggyshetty)
- i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
- platform/x86: intel: chtwc_int33fe: don't dereference swnode args (Bartosz Golaszewski)
- rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
- soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
- soc: apple: mailbox: fix device leak on lookup (Johan Hovold)
- soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
- soc: qcom: pbs: fix device leak on lookup (Johan Hovold)
- soc: samsung: exynos-pmu: fix device leak on regmap lookup (Johan Hovold)
- tracing: Fix fixed array of synthetic event (Steven Rostedt)
- virtio: vdpa: Fix reference count leak in octep_sriov_enable() (Miaoqian Lin)
- amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
- crypto: caam - Add check for kcalloc() in test_len() (Guangshuo Li)
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852311] {CVE-2025-71113}
- dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets (Krzysztof Kozlowski)
- dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets (Krzysztof Kozlowski)
- arm64: Revamp HCR_EL2.E2H RES1 detection (Marc Zyngier)
- KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() (Ahmed Genidi)
- KVM: arm64: Initialize HCR_EL2.E2H early (Mark Rutland)
- sched/rt: Fix race in push_rt_task (Harshit Agarwal) [Orabug: 38158721] {CVE-2025-38234}
- hsr: hold rcu and dev lock for hsr_get_port_ndev (Hangbin Liu)
- pinctrl: renesas: rzg2l: Fix ISEL restore on resume (Claudiu Beznea)
- ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
- ALSA: wavefront: Use guard() for spin locks (Takashi Iwai)
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Denis Arefev)
- drm/displayid: pass iter to drm_find_displayid_extension() (Jani Nikula)
- drm/amd/display: Fix scratch registers offsets for DCN351 (Ray Wu)
- drm/amd/display: Fix scratch registers offsets for DCN35 (Ray Wu)
- drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
- Revert "drm/amd/display: Fix pbn to kbps Conversion" (Mario Limonciello)
- io_uring: fix min_wait wakeups for SQPOLL (Jens Axboe)
- io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe) [Orabug: 38887603] {CVE-2025-71149}
- gpio: regmap: Fix memleak in error path in gpio_regmap_register() (Guan Wentao)
- s390/ipl: Clear SBP flag when bootprog is set (Sven Schnelle)
- btrfs: don't log conflicting inode if it's a dir moved in the current transaction (Filipe Manana) [Orabug: 38847745] {CVE-2025-68778}
- powerpc/kexec: Enable SMT before waking offline CPUs (Nysal Jan K.A.)
- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852340] {CVE-2025-71120}
- svcrdma: use rc_pageoff for memcpy byte offset (Joshua Rogers) [Orabug: 38847896] {CVE-2025-68811}
- svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
- nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
- NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847871] {CVE-2025-68803}
- NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
- net/handshake: restore destructor on submit failure (Caoping) [Orabug: 38887600] {CVE-2025-71148}
- fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847799] {CVE-2025-68788}
- net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Thorsten Blum)
- r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852354] {CVE-2025-71125}
- xfs: fix a UAF problem in xattr repair (Darrick J. Wong) [Orabug: 38847781] {CVE-2025-68784}
- xfs: fix stupid compiler warning (Darrick J. Wong)
- xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
- KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
- KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (Yosry Ahmed)
- KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852272] {CVE-2025-71104}
- KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
- KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
- powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() (Finn Thain)
- libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852324] {CVE-2025-71116}
- parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
- scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
- platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
- KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) (Maxim Levitsky)
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847687] {CVE-2025-68771}
- media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
- KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (Sean Christopherson) [Orabug: 38847894] {CVE-2025-68810}
- tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
- f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
- f2fs: fix uninitialized one_time_gc in victim_sel_policy (Xiaole He)
- f2fs: fix age extent cache insertion skip on counter overflow (Xiaole He)
- f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
- f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
- f2fs: fix to avoid potential deadlock (Chao Yu)
- f2fs: ensure node page reads complete before f2fs_put_super() finishes (Jan Prusakowski)
- scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error (Seunghwan Baek)
- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil)
- scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847769] {CVE-2025-68782}
- NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
- scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848008] {CVE-2025-71075}
- scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847928] {CVE-2025-68818}
- cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
- cpuidle: governors: teo: Drop misguided target residency check (Rafael J. Wysocki)
- serial: sh-sci: Check that the DMA cookie is valid (Claudiu Beznea)
- mei: gsc: add dependency on Xe driver (Junxiao Chang)
- intel_th: Fix error handling in intel_th_output_open (Ma Ke)
- char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
- usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
- usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
- usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
- usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
- usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
- usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal (Duoming Zhou)
- USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
- usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() (Haoxiang Li)
- usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
- phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
- media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
- media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847936] {CVE-2025-68819}
- usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
- mptcp: avoid deadlock on fallback while reinjecting (Paolo Abeni) [Orabug: 38852415] {CVE-2025-71126}
- mptcp: schedule rtx timer only after pushing data (Paolo Abeni)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts)
- media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
- jbd2: use a weaker annotation in journal handling (Byungchul Park)
- jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key (Tetsuo Handa)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848274] {CVE-2025-68820}
- ext4: fix string copying in parse_apply_sb_mount_options() (Fedor Pchelkin) [Orabug: 38852413] {CVE-2025-71123}
- tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848016] {CVE-2025-71077}
- ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- kallsyms: Fix wrong "big" kernel symbol type read from procfs (Zheng Yejian)
- floppy: fix for PAGE_SIZE != 4KB (René Rebe)
- block: rate-limit capacity change info log (Li Chen)
- wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
- s390/dasd: Fix gendisk parent after copy pair swap (Stefan Haberland)
- lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
- perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
- mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
- x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems (Avadhut Naik)
- io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 38847904] {CVE-2025-68814}
- KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen) [Orabug: 38887596] {CVE-2025-71147}
- cifs: Fix memory and information leak in smb3_reconfigure() (Zilin Guan) [Orabug: 38887608] {CVE-2025-71151}
- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
- block: rnbd-clt: Fix signedness bug in init_dev() (Dan Carpenter)
- scsi: scsi_debug: Fix atomic write enable module param description (John Garry)
- MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory Clement)
- platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
- nvme-fabrics: add ENOKEY to no retry criteria for authentication failures (Justin Tee)
- nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
- i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware (Jinhui Guo)
- clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src (Jens Reidel)
- libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map (Ian Rogers)
- serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
- usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
- usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
- iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains (Pei Xiao)
- usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852284] {CVE-2025-71108}
- usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
- exfat: zero out post-EOF page cache on file extension (Yuezhang Mo)
- exfat: fix remount failure in different process environments (Yuezhang Mo)
- reset: fix BIT macro reference (Yongchao Jia)
- via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852317] {CVE-2025-71114}
- fuse: Invalidate the page cache after FOPEN_DIRECT_IO write (Bernd Schubert)
- fuse: Always flush the page cache before FOPEN_DIRECT_IO write (Bernd Schubert)
- scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
- scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
- scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
- powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
- clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &amp; pcie_x4 (Josua Mayer)
- scsi: smartpqi: Add support for Hurray Data new controller PCI device (David Strahan)
- ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
- firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
- scsi: ufs: host: mediatek: Fix shutdown/suspend race condition (Peter Wang)
- ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
- ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
- nfsd: fix memory leak in nfsd_create_serv error paths (Shardul Bankar)
- nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ (Mike Snitzer)
- nfsd: update percpu_ref to manage references on nfsd_net (Mike Snitzer)
- ASoC: ak4458: remove the reset operation in probe and remove (Shengjiu Wang)
- ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847774] {CVE-2025-68783}
- ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
- ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
- x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures (Yongxin Liu)
- net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847723] {CVE-2025-68776}
- dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml (Andrew Jeffery)
- mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds (Sai Krishna Potthuri)
- mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
- spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
- ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
- ACPI: PCC: Fix race condition by removing static qualifier (Pengjie Zhang)
- soc/tegra: fuse: Do not register SoC device on ACPI boot (Kartik)
- can: gs_usb: gs_can_open(): fix error handling (Marc Kleine-Budde)
- xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails (Christoph Hellwig)
- Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: alps - fix use-after-free bugs caused by dev3_register_work (Duoming Zhou) [Orabug: 38847948] {CVE-2025-68822}
- Input: lkkbd - disable pending work before freeing device (Minseong Kim)
- Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
- HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
- ksmbd: fix buffer validation by including null terminator size in EA length (Namjae Jeon)
- ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
- ksmbd: skip lock-range check on equal size to avoid size==0 underflow (Qianchang Zhao)
- hwmon: (ltc4282): Fix reset_history file permissions (Nuno Sa)
- drm/xe/oa: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- drm/xe: Limit num_syncs to prevent oversized allocations (Shuicheng Lin)
- block: rnbd-clt: Fix leaked ID in init_dev() (Thomas Fourier)
- spi: cadence-quadspi: Fix clock disable on probe failure path (Anurag Dutta)
- arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder (Jianpeng Chang)
- x86/xen: Fix sparse warning in enlighten_pv.c (Juergen Gross)
- x86/xen: Move Xen upcall handler (Brian Gerst)
- drm/panel: sony-td4353-jdi: Enable prepare_prev_first (Marijn Suijten)
- MIPS: Fix a reference leak bug in ip22_check_gio() (Haoxiang Li)
- drm/xe: Restore engine registers before restarting schedulers after GT reset (Jan Maslak)
- drm/me/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- hwmon: (tmp401) fix overflow caused by default conversion rate value (Alexey Simakov)
- hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo)
- hwmon: (dell-smm) Limit fan multiplier to avoid overflow (Denis Sergeev)
- net: hns3: add VLAN id validation before using (Jian Shen)
- net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
- net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
- net: enetc: do not transmit redirected XDP frames when the link is down (Wei Fang)
- net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847719] {CVE-2025-68775}
- net/mlx5: Serialize firmware reset with devlink (Shay Drory)
- net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
- net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847913] {CVE-2025-68816}
- net/mlx5: Drain firmware reset in shutdown callback (Moshe Shemesh)
- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Moshe Shemesh)
- ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847825] {CVE-2025-68795}
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Jason Gunthorpe)
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Jason Gunthorpe)
- iommufd/selftest: Update hw_info coverage for an input data_type (Nicolin Chen)
- iommufd/selftest: Add coverage for reporting max_pasid_log2 via IOMMU_HW_INFO (Yi Liu)
- selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel (Florian Westphal)
- netfilter: nf_tables: remove redundant chain validation on register store (Pablo Neira Ayuso)
- netfilter: nf_nat: remove bogus direction check (Florian Westphal)
- nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
- net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847909] {CVE-2025-68815}
- caif: fix integer underflow in cffrml_receive() (Junrui Luo)
- ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847899] {CVE-2025-68813}
- netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera) [Orabug: 38887785] {CVE-2025-71146}
- broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
- net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847783] {CVE-2025-68785}
- bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847683] {CVE-2025-68770}
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
- mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
- mlxsw: spectrum_router: Fix possible neighbour reference count leak (Ido Schimmel)
- ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847964] {CVE-2025-71066}
- netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
- net: fec: ERR007885 Workaround for XDP TX path (Wei Fang)
- gfs2: Fix use of bio_chain (Andreas Gruenbacher)
- Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT (Max Chou)
- Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
- Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 (Chris Lu)
- Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 (Chris Lu)
- Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV (Chingbin Li)
- ksmbd: vfs: fix race on m_flags in vfs_cache (Qianchang Zhao)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- smb/server: fix return value of smb2_ioctl() (Chenxiaosong)
- gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" (Andreas Gruenbacher)
- gfs2: fix remote evict for read-only filesystems (Andreas Gruenbacher)
- btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
- wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet (Hans de Goede)
- wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load (Quan Zhou)
- wifi: cfg80211: use cfg80211_leave() in iftype change (Johannes Berg)
- wifi: cfg80211: stop radar detection in cfg80211_leave() (Johannes Berg)
- wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU (Bitterblue Smith)
- fs/ntfs3: check for shutdown in fsync (Konstantin Komarov)
- hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
- hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
- hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
- hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
- ntfs: set dummy blocksize to read boot_block when mounting (Pedro Demarchi Gomes)
- kbuild: Use objtree for module signing key path (Mikhail Malyshev)
- fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
- livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
- cpuidle: menu: Use residency threshold in polling state override decisions (Aboorva Devarajan)
- cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
- ACPI: fan: Workaround for 64-bit firmware bug (Armin Wolf)
- cpufreq: dt-platdev: Add JH7110S SOC to the allowlist (Hal Feng)
- ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
- ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852332] {CVE-2025-71118}
- x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
- sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847752] {CVE-2025-68780}
- perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847848] {CVE-2025-68798}
- scripts/faddr2line: Fix "Argument list too long" error (Pankaj Raghav)
- iomap: account for unaligned end offsets when truncating read range (Joanne Koong)
- iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847819] {CVE-2025-68794}
- shmem: fix recovery on rename failures (Al Viro) [Orabug: 38847988] {CVE-2025-71072}
- btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
- bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
- btrfs: fix a potential path leak in print_data_reloc_error() (Qu Wenruo)
- btrfs: do not skip logging new dentries when logging a new name (Filipe Manana)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.6.el10uek]" date="1772884800">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong)  [Orabug: 39027305]</changelog>
</package>
<package pkgid="374cd339ac9232bd6ca72afbdebd00fe2365f957" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315]</changelog>
</package>
<package pkgid="a16c1523cea41de995a540a806b8ce78432556a6" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.1.el10uek]" date="1773403200">- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071315] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-200.74.27.2.el10uek]" date="1775649600">- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39186444]  {CVE-2025-40135} 
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39181102]  {CVE-2026-23231} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39181101]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="a7903fe625199760b4ad6e6528fc431341c1837a" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="200.74.27.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.5.el10uek]" date="1768910400">- net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38859067]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-108.64.6.el10uek]" date="1768996800">- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649136,38932973] {CVE-2025-40149}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.1.el10uek]" date="1769515200">- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
- mm: numa,memblock: include &lt;asm/numa.h&gt; for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add "apple,t8103-admac" compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
- LoongArch: Fix PMU counter allocation for mixed-type event groups (Lisa Robinson)
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Seongjae Park) [Orabug: 38970294] {CVE-2026-23144}
- mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
- mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() (Pavel Butsykin)
- nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
- x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
- x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
- i2c: riic: Move suspend handling to NOIRQ phase (Tommaso Merciai)
- tcpm: allow looking for role_sw device in the main node (Arnaud Ferraris)
- EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
- EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
- hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
- ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970600] {CVE-2026-23145}
- ASoC: codecs: wsa881x: fix unnecessary initialisation (Johan Hovold)
- nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
- USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (Johannes Brüderl)
- usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
- phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
- phy: freescale: imx8m-pcie: assert phy reset during power on (Rafael Beims)
- phy: ti: gmii-sel: fix regmap leak on probe failure (Johan Hovold)
- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
- lib/buildid: use __kernel_read() for sleepable context (Shakeel Butt) [Orabug: 38887735] {CVE-2026-23002}
- xfs: Fix the return value of xfs_rtcopy_summary() (Nirjhar Roy)
- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887709] {CVE-2026-22997}
- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. (Ondrej Ille)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914785] {CVE-2026-23031}
- null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] {CVE-2026-23032}
- ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
- scsi: core: Fix error handler encryption support (Brian Kao)
- io_uring: move local task_work in exit cancel loop (Ming Lei)
- drm/amd/display: mark static functions noinline_for_stack (Tzung-Bi Shih)
- ASoC: codecs: wsa883x: fix unnecessary initialisation (Johan Hovold)
- bridge: mcast: Fix use-after-free during router port configuration (Ido Schimmel) [Orabug: 38175058] {CVE-2025-38248}
- HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
- i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA (Neil Armstrong)
- dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
- selftests/landlock: Properly close a file descriptor (Günther Noack)
- phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- selftests/landlock: Remove invalid unix socket bind() (Matthieu Buffet)
- selftests/landlock: Fix TCP bind(AF_UNSPEC) test case (Matthieu Buffet)
- phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors (Xu Wang)
- phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
- phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (Loic Poulain)
- phy: drop probe registration printks (Johan Hovold)
- phy: phy-snps-eusb2: refactor constructs names (Ivaylo Ivanov)
- phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it (Stefano Radaelli)
- dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
- dmaengine: tegra-adma: Fix use-after-free (Sheetal)
- dmaengine: xilinx: xdma: Fix regmap max_register (Anthony Brandon)
- mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
- textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
- mm: describe @flags parameter in memalloc_flags_save() (Bagas Sanjaya)
- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (Yang Wang)
- ASoC: tlv320adcx140: fix word length (Emil Svendsen)
- ASoC: tlv320adcx140: fix null pointer (Emil Svendsen)
- ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Cole Leavitt)
- net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887717] {CVE-2026-22999}
- selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
- ipv6: Fix use-after-free in inet6_addr_del(). (Kuniyuki Iwashima) [Orabug: 38887755] {CVE-2026-23010}
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [Orabug: 38930846] {CVE-2026-23054}
- ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip (Richard Fitzgerald)
- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (Kery Qi)
- btrfs: fix memory leaks in create_space_info() error paths (Jiasheng Jiang)
- btrfs: introduce btrfs_space_info sub-group (Naohiro Aota)
- btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() (Naohiro Aota)
- btrfs: factor out init_space_info() from create_space_info() (Naohiro Aota)
- net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Saeed Mahameed) [Orabug: 38914806] {CVE-2026-23035}
- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) [Orabug: 38887705] {CVE-2026-22996}
- net/mlx5e: Fix crash on profile change rollback failure (Saeed Mahameed) [Orabug: 38887724] {CVE-2026-23000}
- vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
- ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887757] {CVE-2026-23011}
- macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887729] {CVE-2026-23001}
- net: update netdev_lock_{type,name} (Eric Dumazet)
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887737] {CVE-2026-23003}
- net: bridge: annotate data-races around fdb-&gt;{updated,used} (Eric Dumazet)
- btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970283] {CVE-2026-23141}
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887713] {CVE-2026-22998}
- can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
- PM: EM: Fix incorrect description of the cost field in struct em_perf_state (Yaxiong Tian)
- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (Ian Forbes)
- pnfs/blocklayout: Fix memory leak in bl_parse_scsi() (Zilin Guan)
- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914815] {CVE-2026-23038}
- NFS: Fix a deadlock involving nfs_release_folio() (Trond Myklebust) [Orabug: 38930844] {CVE-2026-23053}
- pNFS: Fix a deadlock when returning a delegation during open() (Trond Myklebust) [Orabug: 38930834] {CVE-2026-23050}
- xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set (Antony Antony)
- xfrm: Fix inner mode lookup in tunnel mode GSO segmentation (Jianbo Liu)
- ASoC: codecs: wsa884x: fix codec initialisation (Johan Hovold)
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Sean Christopherson) [Orabug: 38887746] {CVE-2026-23005}
- Revert "gfs2: Fix use of bio_chain" (Andreas Gruenbacher)
- efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
- firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
- LTS version: v6.12.66 (Jack Vogel)
- bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path (Shardul Bankar)
- ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback (Takashi Iwai)
- tpm2-sessions: Fix out of range indexing in name_size (Jarkko Sakkinen) [Orabug: 38847816] {CVE-2025-68792}
- spi: cadence-quadspi: Prevent lost complete() call during indirect read (Mateusz Litwin)
- scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
- ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
- ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL (Kai Vehmanen)
- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (Andrew Elantsev)
- ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
- can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914674] {CVE-2025-71182}
- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (Brian Kocoloski)
- spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ (Fei Shao)
- drm/amd/display: Fix DP no audio issue (Charlene Liu)
- ata: libata-core: Disable LPM on ST2000DM008-2FR102 (Niklas Cassel)
- netfilter: nf_tables: avoid chain re-validation if possible (Florian Westphal) [Orabug: 38887632] {CVE-2025-71160}
- powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
- powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
- net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Marcus Hughes)
- bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887701] {CVE-2026-22994}
- bpf, test_run: Subtract size of xdp_frame from allowed metadata size (Toke Høiland-Jørgensen) [Orabug: 38970281] {CVE-2026-23140}
- bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN (Amery Hung)
- bpf: Make variables in bpf_prog_test_run_xdp less confusing (Amery Hung)
- bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K (Yonghong Song)
- btrfs: fix beyond-EOF write handling (Qu Wenruo)
- btrfs: use variable for end offset in extent_writepage_io() (Filipe Manana)
- btrfs: truncate ordered extent when skipping writeback past i_size (Filipe Manana)
- btrfs: remove btrfs_fs_info::sectors_per_page (Qu Wenruo)
- btrfs: add extra error messages for delalloc range related errors (Qu Wenruo)
- btrfs: subpage: dump the involved bitmap when ASSERT() failed (Qu Wenruo)
- btrfs: fix error handling of submit_uncompressed_range() (Qu Wenruo)
- ALSA: ac97: fix a double free in snd_ac97_controller_register() (Haoxiang Li)
- ALSA: ac97bus: Use guard() for mutex locks (Takashi Iwai)
- erofs: fix file-backed mounts no longer working on EROFS partitions (Gao Xiang)
- erofs: don't bother with s_stack_depth increasing for now (Gao Xiang)
- arp: do not assume dev_hard_header() does not change skb-&gt;head (Eric Dumazet) [Orabug: 38887789] {CVE-2026-22988}
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914760] {CVE-2026-23021}
- net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872324] {CVE-2026-22976}
- HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
- net: netdevsim: fix inconsistent carrier state after link/unlink (Yohei Kojima)
- idpf: cap maximum Rx buffer size (Joshua Hay)
- idpf: fix memory leak in idpf_vport_rel() (Emil Tantilov) [Orabug: 38914769] {CVE-2026-23023}
- idpf: keep the netdev when a reset fails (Emil Tantilov)
- net: fix memory leak in skb_segment_list for GRO packets (Mohammad Heib) [Orabug: 38887655] {CVE-2026-22979}
- riscv: pgtable: Cleanup useless VA_USER_XXX definitions (Guo Ren)
- btrfs: only enforce free space tree if v1 cache is required for bs &lt; ps cases (Qu Wenruo)
- vsock: Make accept()ed sockets use custom setsockopt() (Michal Luczaj)
- bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
- net: wwan: iosm: Fix memory leak in ipc_mux_deinit() (Zilin Guan)
- net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
- netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877945] {CVE-2026-22977}
- inet: ping: Fix icmp out counting (Yuan Gao)
- net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
- net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
- netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970277] {CVE-2026-23139}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Ernest Van Hoecke)
- gpio: pca953x: Add support for level-triggered interrupts (Potin Lai)
- netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
- netfilter: nft_set_pipapo: fix range overlap detection (Florian Westphal)
- arm64: dts: mba8mx: Fix Ethernet PHY IRQ support (Alexander Stein)
- arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart (Sherry Sun)
- arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
- arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
- crypto: qat - fix duplicate restarting msg during AER error (Harshita Bhilwaria)
- arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings (Wadim Egorov)
- drm/amd/display: Apply e4479aecf658 to dml (Nathan Chancellor)
- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (Nathan Chancellor)
- btrfs: fix NULL dereference on root when tracing inode eviction (Miquel Sabaté Solà) [Orabug: 38914692] {CVE-2025-71184}
- btrfs: tracepoints: use btrfs_root_id() to get the id of a root (Filipe Manana)
- btrfs: qgroup: update all parent qgroups when doing quick inherit (Qu Wenruo)
- btrfs: fix qgroup_snapshot_quick_inherit() squota bug (Boris Burkov)
- scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
- scsi: ufs: core: Fix EH failure after W-LUN resume error (Brian Kao)
- scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
- smb/client: fix NT_STATUS_NO_DATA_DETECTED value (Chenxiaosong)
- smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value (Chenxiaosong)
- smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value (Chenxiaosong)
- drm/amd/display: shrink struct members (Rosen Penev)
- NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
- ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
- dm-snapshot: fix 'scheduling while atomic' on real-time kernels (Mikulas Patocka)
- alpha: don't reference obsolete termio struct for TC* constants (Sam James)
- ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
- csky: fix csky_cmpxchg_fixup not working (Yang Li)
- drm/xe: Ensure GT is in C0 during resumes (Xin Wang)
- drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally (Xin Wang)
- libceph: make calc_target() set t-&gt;paused, not just clear it (Ilya Dryomov) [Orabug: 38930820] {CVE-2026-23047}
- libceph: reset sparse-read state in osd_fault() (Sam Edwards) [Orabug: 38970263] {CVE-2026-23136}
- libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887696] {CVE-2026-22992}
- libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887690] {CVE-2026-22991}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887684] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887672] {CVE-2026-22984}
- wifi: mac80211: restore non-chanctx injection behaviour (Johannes Berg)
- wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887649] {CVE-2026-22978}
- pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- gpio: rockchip: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Alex Deucher)
- drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
- drm/amdgpu: Fix query for VPE block_type and ip_count (Alan Liu)
- counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
- counter: 104-quad-8: Fix incorrect return value in IRQ handler (Xu Wang)
- lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
- mei: me: add nova lake point S DID (Alexander Usyskin)
- btrfs: always detect conflicting inodes when logging inode refs (Filipe Manana) [Orabug: 38914680] {CVE-2025-71183}
- arm64: Fix cleared E0POE bit after cpu_suspend()/resume() (Levi Yun)
- net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914754] {CVE-2026-23020}
- atm: Fix dma_free_coherent() size (Thomas Fourier)
- NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
- NFSD: net ref data still needs to be freed even if net hasn't startup (Edward Adam Davis)
- nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887681] {CVE-2026-22989}
- nfsd: use correct loop termination in nfsd4_revoke_states() (Neil Brown)
- nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887658] {CVE-2026-22980}
- NFSD: Fix permission check for read access to executable-only files (Scott Mayhew)
- LTS version: v6.12.65 (Jack Vogel)
- pwm: stm32: Always program polarity (Sean Nyekjaer)
- virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
- sched/fair: Small cleanup to update_newidle_cost() (Peter Zijlstra)
- sched/fair: Small cleanup to sched_balance_newidle() (Peter Zijlstra)
- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844499] {CVE-2025-22111}
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes (Richa Bharti)
- drm/amdgpu: Forward VMID reservation errors (Natalie Vock)
- net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Miaoqian Lin)
- wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852360] {CVE-2025-71127}
- mptcp: ensure context reset on disconnect() (Paolo Abeni) [Orabug: 38852416] {CVE-2025-71144}
- mm: consider non-anon swap cache folios in folio_expected_ref_count() (Bijan Tabatabai)
- mm: simplify folio_expected_ref_count() (David Hildenbrand)
- mm/page_alloc: change all pageblocks migrate type on coalescing (Alexander Gordeev) [Orabug: 38852382] {CVE-2025-71134}
- mptcp: fallback earlier on simult connection (Paolo Abeni) [Orabug: 38848079] {CVE-2025-71088}</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi)  [Orabug: 39033195]  
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde)  [Orabug: 39006240]  
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang)  [Orabug: 38331822]  
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde)  [Orabug: 38331822]  
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde)  [Orabug: 38331822]  
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde)  [Orabug: 38331822]</changelog>
</package>
<package pkgid="c47131db7aea58de33c057927ccae8a086807644" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.2.el10uek]" date="1769601600">- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]  
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]  
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135} 
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
</package>
<package pkgid="a7c5495c12152d047903f3ff00a382525a610b4f" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.2.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.3.el10uek]" date="1770120000">- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing -&gt;mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38741180]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]  
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]  
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]  
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431} 
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]  
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]  
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]  
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]  
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
</package>
<package pkgid="f1db5dfbd1ab9893c79098bba2ca6ad51d39782b" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="201.74.2.3.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.4.el10uek]" date="1770724800">- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&amp;to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-109.67.5.el10uek]" date="1771329600">- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38945524]
- Revert "net/rds: expand kref coverage to rds_notifier-&gt;n_conn" (Sharath Srinivasan) [Orabug: 38945524]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni)
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki)
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai)  [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar)  [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang)  [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech)  [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George)  [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George)  [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George)  [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke)  [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke)  [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke)  [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke)  [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar)  [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar)  [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li)  [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li)  [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li)  [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li)  [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li)  [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li)  [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li)  [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli)  [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar)  [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar)  [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar)  [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala)  [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (arista-hpandya)  [Orabug: 39043148]
- src: add support for FAN-7311H-RED (arista-hpandya)  [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala)  [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (arista-hpandya)  [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty)  [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty)  [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty)  [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon)  [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (arista-hpandya)  [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (arista-hpandya)  [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli)  [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai)  [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian)  [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar)  [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak)  [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak)  [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla)  [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla)  [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak)  [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak)  [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak)  [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla)  [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams)  [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain)  [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva)  [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain)  [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal)  [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal)  [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp)  [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard)  [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak)  [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh)  [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian)  [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan)  [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh)  [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh)  [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh)  [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak)  [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych)  [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe)  [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva)  [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai)  [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai)  [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych)  [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva)  [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych)  [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych)  [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)  [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger)  [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra)  [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp)  [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu)  [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed)  [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi)  [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla)  [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin)  [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann)  [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian)  [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru)  [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran)  [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38667144]
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu)  [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu)  [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas)  [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch)  [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen)  [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey)  [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory)  [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin)  [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch)  [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch)  [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (WangYuli)  [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen)  [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen)  [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen)  [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan)  [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang)  [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy)  [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla)  [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla)  [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko)  [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik)  [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik)  [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik)  [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde)  [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad)  [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang)  [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran)  [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh)  [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman)  [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung)  [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla)  [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad)  [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas)  [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad)  [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas)  [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit)  [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel)  [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche)  [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh)  [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A. R. Silva)  [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman)  [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum)  [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit)  [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky)  [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky)  [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu)  [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao)  [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski)  [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski)  [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit)  [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin)  [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin)  [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel)  [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman)  [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman)  [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu)  [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu)  [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert)  [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak)  [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak)  [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak)  [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)  [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells)  [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang)  [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]  {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi)  [Orabug: 39104869]
- scsi: core: Move two statements (Bart Van Assche)  [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153394]  {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.1.el10uek]" date="1776081600">- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200413]
- io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe)  [Orabug: 39202438]
- ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]  {CVE-2026-23004}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.2.el10uek]" date="1777550400">- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292190]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292190]
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292190]
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292190]  {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292190]
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292190]
- uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp)  [Orabug: 39292173]
- uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39292151]
- x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39292145]</changelog>
  <changelog author="Samasth Norway Ananda &lt;samasth.norway.ananda@oracle.com&gt; [6.12.0-201.74.2.3.el10uek]" date="1778241600">- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39342689]  {CVE-2026-43500} 
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)  [Orabug: 39342689]  
- rxrpc: only handle RESPONSE during service challenge (Wang Jie)  [Orabug: 39342689]  
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)  [Orabug: 39342689]  
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells)  [Orabug: 39342689]  
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39342689]  {CVE-2026-43284}</changelog>
</package>
<package pkgid="cceedd441f5cb6ac2770abbae9458c975af51af0" name="kernel-uek-debug-modules-core" arch="aarch64">
  <version epoch="0" ver="6.12.0" rel="202.76.4.1.el10uek"/>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.67.25.el10uek]" date="1771416000">- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 38925804]
- arm64/pageattr: Propagate return value from __change_memory_common (Dev Jain) [Orabug: 38749874,39004394] {CVE-2025-68737}
- arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context (Ryan Roberts) [Orabug: 38749874]
- perf vendor events arm64 AmpereOne: Fix typos in metrics' descriptions (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Fix use of uninitialized variable (Ilkka Koskinen) [Orabug: 38749874]
- perf/dwc_pcie: Support counting multiple lane events in parallel (Ilkka Koskinen) [Orabug: 38749874]
- arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs (Ryan Roberts) [Orabug: 38749874]
- arm64: mm: support large block mapping when rodata=full (Yang Shi) [Orabug: 38749874]
- arm64: Enable permission change on arm64 kernel block mappings (Dev Jain) [Orabug: 38749874]
- arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED (Huang Shijie) [Orabug: 38749874]
- arm64: mm: Rework the 'rodata=' options (Huang Shijie) [Orabug: 38749874]
- arm64: cpufeature: add AmpereOne to BBML2 allow list (Yang Shi) [Orabug: 38749874]
- arm64: cpufeature: Add Olympus MIDR to BBML2 allow list (Shanker Donthineni) [Orabug: 38749874]
- arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni) [Orabug: 38749874]
- arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature (Kees Cook) [Orabug: 38749874]
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts (Lorenzo Stoakes) [Orabug: 38749874]
- arm64/mm: Elide tlbi in contpte_convert() under BBML2 (Mikołaj Lenczewski) [Orabug: 38749874]
- iommu/arm: Add BBM Level 2 smmu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: Add BBM Level 2 cpu feature (Mikołaj Lenczewski) [Orabug: 38749874]
- arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type (Catalin Marinas) [Orabug: 38749874]
- riscv: mm: call PUD/P4D ctor in special kernel pgtable alloc (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: call PUD/P4D ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: clarify ctor mm argument in alloc_{pte,pmd}_late (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping() (Kevin Brodsky) [Orabug: 38749874]
- arm64: mm: use enum to identify pgtable level instead of *_SHIFT (Kevin Brodsky) [Orabug: 38749874]
- mm: skip ptlock_init() for kernel PMDs (Kevin Brodsky) [Orabug: 38749874]
- sparc64: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- powerpc: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- m68k: mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- mm: call ctor/dtor for kernel PTEs (Kevin Brodsky) [Orabug: 38749874]
- x86: pgtable: always use pte_free_kernel() (Kevin Brodsky) [Orabug: 38749874]
- mm: pass mm down to pagetable_{pte,pmd}_ctor (Kevin Brodsky) [Orabug: 38749874]
- mm: pgtable: introduce generic pagetable_dtor_free() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: completely move pagetable_dtor() to generic tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce generic __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: consolidate PxD and PTE TLB free paths (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- x86: pgtable: convert __tlb_remove_table() to use struct ptdesc (Qi Zheng) [Orabug: 38749874]
- riscv: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- arm: pgtable: move pagetable_dtor() to __tlb_remove_table() (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: introduce pagetable_dtor() (Qi Zheng) [Orabug: 38749874]
- s390: pgtable: add statistics for PUD and P4D level page table (Qi Zheng) [Orabug: 38749874]
- arm64: pgtable: use mmu gather to free p4d level page table (Qi Zheng) [Orabug: 38749874]
- mm: pgtable: add statistics for P4D level page table (Qi Zheng) [Orabug: 38749874]
- asm-generic: pgalloc: provide generic p4d_{alloc_one,free} (Kevin Brodsky) [Orabug: 38749874]
- riscv: mm: skip pgtable level check in {pud,p4d}_alloc_one (Kevin Brodsky) [Orabug: 38749874]
- uek-rpm: disable NUMA and THP in embedded4 config (Dara Stotland) [Orabug: 38889577]
- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (Yury Norov) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.12 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Add capability to register Platform Name ID to fabric (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Allow support for BB credit recovery in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify kref handling for Fabric Controller ndlps (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Ensure unregistration of rpis for received PLOGIs (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise discovery related function headers and comments (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update various NPIV diagnostic log messaging (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.11 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.11 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use int type to store negative error codes (Rong Qianfeng) [Orabug: 38886419]
- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38886419]
- scsi: lpfc: use min() to improve code (Rong Qianfeng) [Orabug: 38886419]
- PCI/ERR: Remove remnants of .link_reset() callback (Lukas Wunner) [Orabug: 38886419]
- scsi: lpfc: Fix wrong function reference in a comment (Jean Delvare) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.10 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.10 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Modify end-of-life adapters' model descriptions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update debugfs trace ring initialization messages (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Revise logging format for failed CT MIB requests (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Copyright updates for 14.4.0.9 patches (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Update lpfc version to 14.4.0.9 (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Create lpfc_vmid_info sysfs entry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Prevent failure to reregister with NVMe transport after PRLI retry (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Restart eratt_poll timer if HBA_SETUP flag still unset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Notify FC transport of rport disappearance during PCI fcn reset (Justin Tee) [Orabug: 38886419]
- scsi: lpfc: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38886419]
- scsi: lpfc: Fix spelling mistake 'Toplogy' -&gt; 'Topology' (Colin Ian King) [Orabug: 38886419]
- scsi: lpfc: Convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- jiffies: Define secs_to_jiffies() (Easwar Hariharan) [Orabug: 38886419]
- arista-sonic/amax31732: Fix build error form probe (Vijay Kumar) [Orabug: 38526339]
- Build Arista SONIC SCD driver (Vijay Kumar) [Orabug: 38526339]
- Import Arista SONiC driver (src → drivers/platform/arista-sonic) (Vijay Kumar) [Orabug: 38526339]
- uek-rpm/kernel-uek.spec: Build uek kernel for ONOS (Vijay Kumar) [Orabug: 38526339]
- Add config to support ONOS platforms (Vijay Kumar) [Orabug: 38526339]
- support reading mdio config from ACPI tables (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- mtd: spi nor core driver update to support ACPI table match (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- hwmon: (pmbus) Add support for MPS Multi-phase mp2855 controller (Vadim Pasternak) [Orabug: 38526339]
- fix os crash caused by optoe when class switch (Philo) [Orabug: 38526339]
- mtd: Add support for reading partition data from ACPI (Madhava Reddy Siddareddygari) [Orabug: 38526339]
- i2c: asf: Introduce MCTP support over ASF controller (Amlakshm) [Orabug: 38526339]
- Add Nvidia-specific wrapper function for the psample driver (Vadym Hlushko) [Orabug: 38526339]
- tg3: fix broadcom NIC 57766 staying down issue (Boyang Yu) [Orabug: 38526339]
- Add 2 more parameter for tg3.c. (Roy Lee) [Orabug: 38526339]
- Dynamic write timeout support for optoe driver (Mihir Patel) [Orabug: 38526339]
- Update optoe support for Linux 6.1 (Saikrishna Arcot) [Orabug: 38526339]
- Read ID register to find pageable bit in optoe driver (Mihir Patel) [Orabug: 38526339]
- A2h access for optoe2 even when DDM is unsupported (Jemston Fernando) [Orabug: 38526339]
- Dynamic write_max support for optoe driver (Prince George) [Orabug: 38526339]
- drivers/misc/eeprom: Support QSFP-DD (CMIS) type devices (Don Bollinger) [Orabug: 38526339]
- eeprom/optoe: Correct a panic inducing defect which is triggered on a read (or write) (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Improve EOF handling (Don Bollinger) [Orabug: 38526339]
- drivers/misc/eeprom: Add optoe driver (SFP/QSFP EEPROM Read/Write) (Don Bollinger) [Orabug: 38526339]
- Add 'delay' module param to the driver. (Cumulus Networks) [Orabug: 38526339]
- Fix calculation of page_len in sff_8436_read_write function (Yurypm) [Orabug: 38526339]
- replace memory_accessor with nvmem_device_read (Guohan Lu) [Orabug: 38526339]
- extend driver to plug into the NVMEM framework (Guohan Lu) [Orabug: 38526339]
- Update SFF8436 EEPROM driver (Shuotian Cheng) [Orabug: 38526339]
- Driver to expose eeprom information including DOM for QSFPs (Cumulus Networks) [Orabug: 38526339]
- amd/mmc: mmcblk not working on some AMD platforms (Vijay Kumar) [Orabug: 38526339]
- Release prefecth memory resources assigned by the BIOS (Baptiste Covolato) [Orabug: 38526339]
- Fix kernel hangs seen and easily reproducable using ethtool -t (Samuel Angebault) [Orabug: 38526339]
- Recover the MAC with the one previously saved by Arista Aboot (Boyang Yu) [Orabug: 38526339]
- Force DMA accesses to be done in the 4G range due to a SB800 limitation (Samuel Angebault) [Orabug: 38526339]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64-embedded config (Dave Kleikamp) [Orabug: 38894100]
- crypto: octeontx2: fix buffer size to include enc key length + nonce (Amit Singh Tomar) [Orabug: 38894100]
- uek-rpm: T93: Build mvl_mhu module into kernel (Dave Kleikamp) [Orabug: 38894100]
- arm64: errata: Add missing sentinel (Geetha Sowjanya) [Orabug: 37977182,38894100] {CVE-2025-37929}
- uek-rpm: T93: build Octeon info driver (Dave Kleikamp) [Orabug: 38850588]
- drivers: soc: marvell: octeontx_info: Fix parsing of two fdt properties (Felix Manlunas) [Orabug: 38850588]
- drives: soc: marvell: Using struct proc_ops instead of file_operations (Piyush Malgujar) [Orabug: 38850588]
- drives: soc: marvell: Update octtx_info to display sdk-version (Chandrakala Chavva) [Orabug: 38850588]
- drives: soc: marvell: Fix issues reported by static code analysis (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: update to support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Remove unnecessary warnings about reset counters (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: support to print reset counters (Selvam Venkatachalam) [Orabug: 38850588]
- drives: soc: marvell: Fixes conversion for BOARD-MAC-ADDRESS-ID-NUM in octeontx_info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fixes unnecessary logging from octeontx info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Fix OcteonTX info driver (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Adds MAC addressess overview to board info (Wojciech Bartczak) [Orabug: 38850588]
- drives: soc: marvell: Display version information for flash components (Aaron Williams) [Orabug: 38850588]
- drives: soc: marvell: publish no of macs in octeontx_info node (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Alter ways of mac address parsing (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board info logic reorg (Sujeet Baranwal) [Orabug: 38850588]
- drives: soc: marvell: Board information made available (Sujeet Baranwal) [Orabug: 38850588]
- drivers: soc: Adds common Marvell OcteonTX header for SMC calls (Sdonelli) [Orabug: 38850588]
- uek-rpm: T93: Build pci console driver (Dave Kleikamp) [Orabug: 38850588]
- Change struct octeontx2_pcie_console_nexus (Ray Asbury) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- drivers: soc: marvell: Add PCI console driver (Rick Farrington) [Orabug: 38850588]
- uek-rpm: T93: add hw_access module (Dave Kleikamp) [Orabug: 38850588]
- soc: marvell: hw-access: add mapping for TAD (Pavan Nikhilesh) [Orabug: 38850588]
- soc: marvell: hw_access: add ioctl to get link info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI PF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for DPI VF BAR0 (Ankur Dwivedi) [Orabug: 38850588]
- drivers: marvell: Fix klockwork issues (Suman Ghosh) [Orabug: 38850588]
- soc: marvell: hw_access: add mapping for mcs registers (Ankur Dwivedi) [Orabug: 38850588]
- soc: marvell: hw-access: register access via debugfs (Sumit Gaur) [Orabug: 38850588]
- soc: marvell: hw_access: fix pci resource leak (Harman Kalra) [Orabug: 38850588]
- soc: marvell: hw_access: fix csr mapping range (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: Extend available ranges (Jakub Palider) [Orabug: 38850588]
- soc: marvell: hw_access: add support to read aura/pool context (Ashwin Sekhar T K) [Orabug: 38850588]
- soc: marvell: hw_access: get cgx info (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: hw_access: add hw context reading support (Gowthami Thiagarajan) [Orabug: 38850588]
- soc: marvell: Driver to access and modify device CSRs. (Gowthami Thiagarajan) [Orabug: 38850588]
- octeontx2-af: extend npa context reading capability (Ashwin Sekhar T K) [Orabug: 38850588]
- arm64: Add workaround for Cavium erratum 36890 (Andrew Pinski) [Orabug: 38850588]
- arm64: errata: Extend Errata-38627 workaround to new affected parts (Bharat Bhushan) [Orabug: 38850588]
- KVM: arm64: Extend timer errata-38627 to kvm (Bharat Bhushan) [Orabug: 38850588]
- clocksource: Add Marvell Errata-38627 workaround (Bharat Bhushan) [Orabug: 38850588]
- uek-rpm: T93: build MHU Mailbox (Dave Kleikamp) [Orabug: 38850588]
- mailbox: mvl-mhu: ioremap error handling fixed (Damian Eppel) [Orabug: 38850588]
- mailbox: add OcteonTX2 MHU mailbox driver (Wojciech Bartczak) [Orabug: 38850588]
- crypto: octeontx2: Hide fortified memcpy warning (Dave Kleikamp) [Orabug: 38850588]
- crypto: octeontx2: fix aes_cbc with 6.1 kernel (Srujana Challa) [Orabug: 38850588]
- fips: exclude crypto_simd from FIPS module for aarch64 (Saeed Mirzamohammadi) [Orabug: 38862017]
- fips: clean up redundant Makefile (Saeed Mirzamohammadi) [Orabug: 38820413]
- uek-rpm: make simd built-in for FIPS (Saeed Mirzamohammadi) [Orabug: 38820413]
- crypto: convert crypto_simd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38820413]
- xfs: enable online fsck by default in Kconfig (Darrick J. Wong) [Orabug: 38313145]
- xfs: remove some EXPERIMENTAL warnings (Darrick J. Wong) [Orabug: 38313145]
- sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404539]
- uek-rpm: Enable CONFIG_MEM_ALLOC_PROFILING (Vishal Moola) [Orabug: 38405199]
- rhashtable: Add allocation tagging hooks (Vishal Moola) [Orabug: 38405199]
- Revert "rhashtable: plumb through alloc tag" (Vishal Moola) [Orabug: 38405199]
- UEK: kABI: Use kABI padding in task_struct (Vishal Moola) [Orabug: 38405199]
- memcg: multi-memcg percpu charge cache (Shakeel Butt) [Orabug: 38472779]
- rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492232]
- uek-rpm: BF3/BF4: Enable CONFIG_PINCTRL_MLXBF3 and CONFIG_LAN743X (Thomas Tai) [Orabug: 38784578]
- uek: kabi: update FIPS kABI files (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek-rpm: Add reservations for the symbols used by fips140 module (Harshit Mogalapalli) [Orabug: 38764635]
- uek: add FIPS kABI checking in spec files (Saeed Mirzamohammadi) [Orabug: 38764635]
- Revert "uek: kabi: update kABI files for FIPS symbols" (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: ensure genksyms updates CRC for SCK keys (Saeed Mirzamohammadi) [Orabug: 38764635]
- uek: kabi: clean up extra debug files (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: tcrypt: use resolved driver info for self-tests (Saeed Mirzamohammadi) [Orabug: 38764635]
- crypto: convert scompress/acompress to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38764635]
- fips: don't export aesgcm functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- fips: don't export gf128mul functions from the FIPS module (Vegard Nossum) [Orabug: 38764635]
- uek-rpm: Change TRUSTED_KEYS from m to y on aarch64 configs (Harshit Mogalapalli) [Orabug: 38266493]
- dm mpath: enable DM_TARGET_ATOMIC_WRITES (John Garry) [Orabug: 38686264]
- dm-crypt: enable DM_TARGET_ATOMIC_WRITES (Mikulas Patocka) [Orabug: 38748184]
- dm: test for REQ_ATOMIC in dm_accept_partial_bio() (Mikulas Patocka) [Orabug: 38748184]
- NFSD: Add a Kconfig setting to enable delegated timestamps (Chuck Lever) [Orabug: 38696904]
- scsi: target: Add atomic support to target_core_iblock (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 support to RSOC (Mike Christie) [Orabug: 38675526]
- scsi: target: Report atomic values in INQUIRY (Mike Christie) [Orabug: 38675526]
- scsi: target: Add WRITE_ATOMIC_16 handler (Mike Christie) [Orabug: 38675526]
- scsi: target: Add helper to set up atomic values from block_device (Mike Christie) [Orabug: 38675526]
- scsi: target: Add atomic se_device fields (Mike Christie) [Orabug: 38675526]
- scsi: target: Rename target_configure_unmap_from_queue() (Mike Christie) [Orabug: 38675526]
- KVM: x86/mmu: Treat TDP MMU faults as spurious if access is already allowed (Sean Christopherson) [Orabug: 38609061]
- uek-rpm: BF3: Rework BF3 configuration file to resolve boot error with FIPS mode enabled (Thomas Tai) [Orabug: 38605739]
- uek-rpm: Fix packaging fips140.ko.debug files into kernel-uek (Harshit Mogalapalli) [Orabug: 38592440]
- crypto/jitterentropy: do not hand-define core kernel types (Nick Alcock) [Orabug: 38589527]
- net/mlx5: DR, use the right action structs for STEv3 (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: Restore missing trace event when enabling vport QoS (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Fix vport QoS cleanup on error (Carolina Jubran) [Orabug: 37984345,39004160] {CVE-2025-21882}
- net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq (Stanislav Fomichev) [Orabug: 37984345,39004175] {CVE-2025-21717}
- platform/mellanox: mlxreg-io: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- platform/mellanox: mlxreg-hotplug: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37984345]
- mlxsw: Do not store Tx header length as driver parameter (Amit Cohen) [Orabug: 37984345]
- mlxsw: Move Tx header handling to PCI driver (Amit Cohen) [Orabug: 37984345]
- mlxsw: Define Tx header fields in txheader.h (Amit Cohen) [Orabug: 37984345]
- mlxsw: Initialize txhdr_info according to PTP operations (Amit Cohen) [Orabug: 37984345]
- mlxsw: Add mlxsw_txhdr_info structure (Amit Cohen) [Orabug: 37984345]
- net/mlx5: fix unintentional sign extension on shift of dest_attr-&gt;vport.vhca_id (Colin Ian King) [Orabug: 37984345]
- net/mlx5e: CT: Offload connections with hardware steering rules (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Make mlx5_ct_fs_smfs_ct_validate_flow_rule reusable (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5e: CT: Add initial support for Hardware Steering (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: HWS, rework the check if matcher size can be increased (Yevgeny Kliteynik) [Orabug: 37984345]
- selftests/net/forwarding: teamd command not found (Alessandro Zanni) [Orabug: 37984345]
- net/mlx5: HWS, update flow - support through bigger action RTC (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, update flow - remove the use of dual RTCs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, add HWS to steering mode options (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS get capabilities (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, set create match definer to not supported by HWS (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add support for dest vport HWS action (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS fte API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add dest table cache (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, manage flow counters HWS action sharing by refcount (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS modify header API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS packet reformat API function (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS actions pool (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow group API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS flow table API functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: fs, add HWS root namespace functions (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: SHAMPO: Introduce new SHAMPO specific HCA caps (Saeed Mahameed) [Orabug: 37984345]
- net/mlx5: Add support for MRTCQ register (Jianbo Liu) [Orabug: 37984345]
- netdevsim: add queue management API support (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: add queue alloc/free helpers (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: allocate rqs individually (Jakub Kicinski) [Orabug: 37984345]
- netdevsim: support NAPI config (Jakub Kicinski) [Orabug: 37984345]
- net/mlx5e: Update TX ESN context for IPSec hardware offload (Jianbo Liu) [Orabug: 37984345]
- xfrm: Support ESN context update to hardware for TX (Jianbo Liu) [Orabug: 37984345]
- net/mlx5: HWS, set timeout on polling for completion (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, support flow sampler destination (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, use the right size when writing arg data (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, handle returned error value in pool alloc (Vlad Dogaru) [Orabug: 37984345]
- net/mlx5: HWS, separate SQ that HWS uses from the usual traffic SQs (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, num_of_rules counter on matcher should be atomic (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, reduce memory consumption of a matcher struct (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove wrong deletion of the miss table list (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, add error message on failure to move rules (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, simplify allocations as we support only FDB (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, denote how refcounts are protected (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove implementation of unused FW commands (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, remove the use of duplicated structs (Yevgeny Kliteynik) [Orabug: 37984345]
- RDMA/mlx5: Fix link status down event for MPV (Patrisious Haddad) [Orabug: 37984345]
- RDMA/mlx5: Handle link status event only for LAG device (Yuyu Li) [Orabug: 37984345]
- RDMA/mlx4: Support report_port_event() ops (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Support link status events dispatching (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Add ib_query_netdev_port() to query netdev port by IB device. (Yuyu Li) [Orabug: 37984345]
- RDMA/core: Remove unused ibdev_printk (Dr. David Alan Gilbert) [Orabug: 37984345]
- net/mlx5: Remove PTM support log message (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: DR, add support for ConnectX-8 steering (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: DR, expand SWS STE callbacks and consolidate common structs (Itamar Gozlan) [Orabug: 37984345]
- net/mlx5: HWS, do not initialize native API queues (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: HWS, no need to expose mlx5hws_send_queues_open/close (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: fs, retry insertion to hash table on EBUSY (Mark Bloch) [Orabug: 37984345]
- net/mlx5: fs, add mlx5_fs_pool API (Moshe Shemesh) [Orabug: 37984345]
- net/mlx5: LAG, Support LAG over Multi-Host NICs (Rongwei Liu) [Orabug: 37984345]
- net/mlx5: LAG, Refactor lag logic (Rongwei Liu) [Orabug: 37984345]
- char:ipmi: Fix a not-used variable on a non-ACPI system (Corey Minyard) [Orabug: 37984345]
- net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao) [Orabug: 37984345]
- mlxsw: Switch to napi_gro_receive() (Ido Schimmel) [Orabug: 37984345]
- net/mlx5: Add device cap abs_native_port_num (Rongwei Liu) [Orabug: 37984345]
- mlxsw: spectrum_flower: Do not allow mixing sample and mirror actions (Ido Schimmel) [Orabug: 37984345]
- RDMA/mlx4: Use DMA iterator to write MTT (Leon Romanovsky) [Orabug: 37984345]
- RDMA/mlx4: Use ib_umem_find_best_pgsz() to calculate MTT size (Leon Romanovsky) [Orabug: 37984345]
- net/mlx5: qos: Add ifc support for cross-esw scheduling (Cosmin Ratiu) [Orabug: 37984345]
- net/mlx5: Add support for new scheduling elements (Carolina Jubran) [Orabug: 37984345]
- net/mlx5: Add ConnectX-8 device to ifc (Yevgeny Kliteynik) [Orabug: 37984345]
- net/mlx5: ifc: Reorganize mlx5_ifc_flow_table_context_bits (Cosmin Ratiu) [Orabug: 37984345]
- RDMA/nldev: Add IB device and net device rename events (Chiara Meiohas) [Orabug: 37984345]
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 37944844,38440365] {CVE-2025-39832}
- net-shapers: implement cap validation in the core (Paolo Abeni) [Orabug: 37944844]
- net: shaper: implement introspection support (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper introspection support (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement shaper cleanup on queue deletion (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement delete support for NODE scope shaper (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL group operation (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL set and delete operations (Paolo Abeni) [Orabug: 37944844]
- net-shapers: implement NL get operation (Paolo Abeni) [Orabug: 37944844]
- netlink: spec: add shaper YAML spec (Paolo Abeni) [Orabug: 37944844]
- genetlink: extend info user-storage to match NL cb ctx (Paolo Abeni) [Orabug: 37944844]
- EDAC/bluefield: Don't use bluefield_edac_readl() result on error (David Thompson) [Orabug: 37944844]
- xsk: Bring back busy polling support in XDP_COPY (Samiullah Khawaja) [Orabug: 37944844]
- net: page_pool: don't try to stash the napi id (Jakub Kicinski) [Orabug: 37944844]
- xsk: Bring back busy polling support (Stanislav Fomichev) [Orabug: 37944844]
- net: Make napi_hash_lock irq safe (Joe Damato) [Orabug: 37944844]
- virtchnl: fix m68k build. (Paolo Abeni) [Orabug: 37944844]
- net/mlx5: fs, Add support for RDMA RX steering over IB link layer (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Extend ODP statistics with operation count (Chiara Meiohas) [Orabug: 37944844]
- Fix a potential abuse of seq_printf() format string in drivers (David Wang) [Orabug: 37944844]
- i2c: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Rework header allocation loop (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Drop info array (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Change frag page setup order during allocation (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Fix page_index calculation inconsistency (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: SHAMPO, Simplify UMR allocation for headers (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5: Make vport QoS enablement more flexible for future extensions (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Integrate esw_qos_vport_enable logic into rate operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize scheduling element operations (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor scheduling element configuration bitmasks (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Generalize max_rate and min_rate setting for nodes (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS normalization by removing error handling (Carolina Jubran) [Orabug: 37944844]
- mlx5/core: deduplicate {mlx5_,}eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- mlx5/core: relax memory barrier in eq_update_ci() (Caleb Sander) [Orabug: 37944844]
- netdevsim: add more hw_features (Sabrina Dubroca) [Orabug: 37944844]
- mlx5/core: Schedule EQ comp tasklet only if necessary (Caleb Sander) [Orabug: 37944844]
- mlx5_en: use read sequence for gettimex64 (Vadim Fedorenko) [Orabug: 37944844]
- RDMA/mlx5: Add implementation for ufile_hw_cleanup device operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Move ib_uverbs_file struct to uverbs_types.h (Patrisious Haddad) [Orabug: 37944844]
- RDMA/core: Add device ufile cleanup operation (Patrisious Haddad) [Orabug: 37944844]
- RDMA/mlx5: Support querying per-plane IB PortCounters (Mark Zhang) [Orabug: 37944844]
- RDMA/mlx5: Support OOO RX WQE consumption (Edward Srouji) [Orabug: 37944844]
- net/mlx5: Introduce data placement ordering bits (Edward Srouji) [Orabug: 37944844]
- net/mlx5e: do not create xdp_redirect for non-uplink rep (William Tu) [Orabug: 37944844]
- net/mlx5e: move XDP_REDIRECT sq to dynamic allocation (William Tu) [Orabug: 37944844]
- net/mlx5: HWS, renamed the files in accordance with naming convention (Yevgeny Kliteynik) [Orabug: 37944844]
- net/mlx5: Rework esw qos domain init and cleanup (Cosmin Ratiu) [Orabug: 37944844]
- dim: pass dim_sample to net_dim() by reference (Caleb Sander) [Orabug: 37944844]
- dim: make dim_calc_stats() inputs const pointers (Caleb Sander) [Orabug: 37944844]
- net/mlx5: DPLL, Add clock quality level op implementation (Jiri Pirko) [Orabug: 37944844]
- dpll: add clock quality level attribute and op (Jiri Pirko) [Orabug: 37944844]
- mlx5: simplify EQ interrupt polling logic (Caleb Sander) [Orabug: 37944844]
- mlx5: fix typo in "mlx5_cqwq_get_cqe_enahnced_comp" (Caleb Sander) [Orabug: 37944844]
- net/mlx5e: Update features on ring size change (Dragos Tatulea) [Orabug: 37944844]
- net/mlx5e: Update features on MTU change (Dragos Tatulea) [Orabug: 37944844]
- netdevsim: macsec: pad u64 to correct length in logs (Ales Nezbeda) [Orabug: 37944844]
- EDAC/bluefield: Use Arm SMC for EMI access on BlueField-2 (David Thompson) [Orabug: 37944844]
- selftests: mlxsw: devlink_trap_police: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_max_descriptors: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_ets_strict: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: qos_mc_aware: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: ETS: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- selftests: RED: Use defer for test cleanup (Petr Machata) [Orabug: 37944844]
- net/mlx5: fs, rename modify header struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: fs, rename packet reformat struct member action (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Only create VEPA flow table when in VEPA mode (Benjamin Poirier) [Orabug: 37944844]
- net/mlx5: Add sync reset drop mode support (Moshe Shemesh) [Orabug: 37944844]
- net/mlx5: Generalize QoS operations for nodes and vports (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Simplify QoS scheduling element configuration (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Remove vport QoS enabled flag (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport QoS to use scheduling node structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor vport scheduling element creation function (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node struct and rename group terminology to node (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Rename vport QoS group reference to parent (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Restrict domain list insertion to root TSAR ancestors (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Add parent group support in rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Introduce node type to rate group structure (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Refactor QoS group scheduling element creation (Carolina Jubran) [Orabug: 37944844]
- platform/x86: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- mlx4: Add support for persistent NAPI config to RX CQs (Joe Damato) [Orabug: 37944844]
- mlx5: Add support for persistent NAPI config (Joe Damato) [Orabug: 37944844]
- net: napi: Add napi_config (Joe Damato) [Orabug: 37944844]
- net: napi: Make gro_flush_timeout per-NAPI (Joe Damato) [Orabug: 37944844]
- net: napi: Make napi_defer_hard_irqs per-NAPI (Joe Damato) [Orabug: 37944844]
- mmc: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- virtchnl: support queue rate limit and quanta size configuration (Wenjun Wu) [Orabug: 37944844]
- net/mlx5: Add support check for TSAR types in QoS scheduling (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: Unify QoS element type checks across NIC and E-Switch (Carolina Jubran) [Orabug: 37944844]
- net/mlx5: qos: Refactor locking to a qos domain mutex (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store rate groups in a qos domain (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename rate group 'list' as 'parent_entry' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Add an explicit 'dev' to vport trace calls (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Store the eswitch in a mlx5_esw_rate_group (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Drop 'esw' param from vport qos functions (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Always create group0 (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Maintain rate group vport members in a list (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Refactor and document bw_share calculation (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Consistently name vport vars as 'vport' (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Rename vport 'tsar' into 'sched_elem'. (Cosmin Ratiu) [Orabug: 37944844]
- net/mlx5: qos: Flesh out element_attributes in mlx5_ifc.h (Cosmin Ratiu) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Lower TBF rate (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Send more packets for drop tests (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Sleep before querying queue depth (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_core: Increase backlog size tolerance (Petr Machata) [Orabug: 37944844]
- selftests: mlxsw: sch_red_ets: Increase required backlog (Petr Machata) [Orabug: 37944844]
- ipv4: remove fib_info_lock (Eric Dumazet) [Orabug: 37944844]
- ipv4: use rcu in ip_fib_check_default() (Eric Dumazet) [Orabug: 37944844]
- ipv4: remove fib_devindex_hashfn() (Eric Dumazet) [Orabug: 37944844]
- net: ethernet: Switch back to struct platform_driver::remove() (Uwe Kleine-König) [Orabug: 37944844]
- selftests: mlxsw: rtnetlink: Use devlink_reload() API (Amit Cohen) [Orabug: 37944844]
- ipv4: avoid quadratic behavior in FIB insertion of common address (Alexandre Ferrieux) [Orabug: 37944844]
- Revert "net/mlx5: Fix lockdep assertion on sync reset unload event" (Qing Huang) [Orabug: 37944844]
- uek-rpm: BF3: build BF3 smartnic kernel (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: add denylist.txt.S.emb3 and modules.yaml.S.emb3 (Thomas Tai) [Orabug: 38551182]
- uek-rpm: BF3: Add config file for BF3 smartnic (Thomas Tai) [Orabug: 38551182]
- uek: kabi: update kABI files for FIPS symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek: update spec files to include FIPS symvers (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: Enable CRYPTO_FIPS140_EXTMOD in the spec file (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert all DECLARE_CRYPTO_API[0-6] macros to DECLARE_CRYPTO_API (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: set new FIPS module name (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips/fips140-glue.c: fips_name/fips_version lengths (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr.c: fix crash in __alg_test_hash (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: build FIPS module in kernel-uek.spec (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: enable ECDH and ECC configs (Saeed Mirzamohammadi) [Orabug: 38493695]
- uek-rpm: make cryptd built-in to the kernel (Saeed Mirzamohammadi) [Orabug: 38493695]
- scripts/extract-fips: add script to extract FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add zstd to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo-rle to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lzo to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4hc to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lz4 to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-ce to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crct10dif-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32c-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crc32-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add xxhash64-generic to FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark xxhash64 as non-cryptographic (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: scripts and glue for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/fips140: add FIPS 140 module loader (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add ecdh to fips module to fix the TPM issue (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/arm64/crypto: fix module_cpu_feature_match (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/x86: CRYPTO_MODULE_DEVICE_TABLE (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: change module_init/exit to crypto_module_init/exit (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add lib crypto algos to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add crypto/crypto_null.c to module (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: add sig.c to fips module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert geniv to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert skcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rng to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert lskcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert kpp to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert akcipher to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aead to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- fips: adjust two arm64 symbols (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert asymmetric_keys to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha256_generic: embed lib/crypto/sha256.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/sha1_generic: embed lib/crypto/sha1.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert rsa/rsa_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert ecc to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert aes_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert dh/dh_helper to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha256_generic/sha512_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha3_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert sha1_generic to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert testmgr to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert hash/shash/ahash to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert cryptd to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert algapi.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: convert api.c to CRYPTO_API() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/aes_generic: embed lib/crypto/aes.c (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: only apply crypto API fixups for load_module_mem() (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: avoid modifying struct module (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add a mechanism for pluggable crypto APIs (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: Kconfig - add CRYPTO_FIPS140_EXTMOD (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: keep initial module reference with MODULE_INIT_MEM (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: fix init_module02 and finit_module02 (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add MODULE_INIT_MEM flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- module: add load_module_mem() helper (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: make sure crypto_alg_tested() finds the correct algorithm (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: testmgr: check that we got the expected alg (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: alg - add CRYPTO_ALG_FIPS_PROVIDED flag (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: pass struct crypto_alg directly to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: add helper to alg_test() (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi.c: disable crypto_check_module_sig() for FIPS module (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/algapi: don't init algapi in fips mode (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: mark non-crypto algorithms (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/testmgr: make fips_allowed a bit set (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/crypto_user: don't overwrite net-&gt;crypto_nlsk on error (Saeed Mirzamohammadi) [Orabug: 38493695]
- certs/system_keyring: export restrict_link_by_builtin_*trusted (Saeed Mirzamohammadi) [Orabug: 38493695]
- lib/crypto/mpi/mpi-bit.c: export mpi_set_bit (Saeed Mirzamohammadi) [Orabug: 38493695]
- arch/x86/boot/string.h: override memmove()/strlen() (Saeed Mirzamohammadi) [Orabug: 38493695]
- libcrc32c: panic on failure (Saeed Mirzamohammadi) [Orabug: 38493695]
- testmgr: standardize alg/driver output in logs (Saeed Mirzamohammadi) [Orabug: 38493695]
- KEYS: trusted: eat -ENOENT from the crypto API (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: hide crypto_default_rng (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto: api - Disallow identical template names (Saeed Mirzamohammadi) [Orabug: 38493695]
- crypto/jitterentropy.c: use kernel's ARRAY_SIZE (Saeed Mirzamohammadi) [Orabug: 38493695]
- params: use arch_initcall (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "Revert "crypto: shash - avoid comparing pointers to exported functions under CFI"" (Saeed Mirzamohammadi) [Orabug: 38493695]
- Revert "extract-vmlinux: Check for uncompressed image as fallback" (Saeed Mirzamohammadi) [Orabug: 38493695]
- cifs: Do not query WSL EAs for native SMB symlink (Pali Rohár) [Orabug: 37978666]
- Fix SMB311 posix special file creation to servers which do not advertise reparse support (Steve French) [Orabug: 37978666]
- smb: client: fix native SMB symlink traversal (Paulo Alcantara) [Orabug: 37978666]
- smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [Orabug: 37978666,39004184] {CVE-2025-38431}
- cifs: Fix support for WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Check if server supports reparse points before using them (Pali Rohár) [Orabug: 37978666]
- cifs: Fix parsing native symlinks directory/file type (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating NFS-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Add support for creating native Windows sockets (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o reparse=none (Pali Rohár) [Orabug: 37978666]
- cifs: Add mount option -o symlink= for choosing symlink create type (Pali Rohár) [Orabug: 37978666]
- cifs: Fix creating and resolving absolute NT-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Simplify reparse point check in cifs_query_path_info() function (Pali Rohár) [Orabug: 37978666]
- cifs: Rename struct reparse_posix_data to reparse_nfs_data_buffer and move to common/smb2pdu.h (Pali Rohár) [Orabug: 37978666]
- cifs: Remove struct reparse_posix_data from struct cifs_open_info_data (Pali Rohár) [Orabug: 37978666]
- cifs: Remove unicode parameter from parse_reparse_point() function (Pali Rohár) [Orabug: 37978666]
- cifs: Change translation of STATUS_NOT_A_REPARSE_POINT to -ENODATA (Pali Rohár) [Orabug: 37978666]
- cifs: Remove duplicate struct reparse_symlink_data and SYMLINK_FLAG_RELATIVE (Pali Rohár) [Orabug: 37978666]
- smb3: add missing tracepoint for querying wsl EAs (Steve French) [Orabug: 37978666]
- smb3: fix compiler warning in reparse code (Steve French) [Orabug: 37978666]
- cifs: Add support for parsing WSL-style symlinks (Pali Rohár) [Orabug: 37978666]
- cifs: Validate content of native symlink (Pali Rohár) [Orabug: 37978666]
- uek-rpm: Enable CONFIG_INTEL_TDX_HOST (Liam Merwick) [Orabug: 38359602]
- KVM: TDX: Fix uninitialized error code for __tdx_bringup() (Tony Lindgren) [Orabug: 38359602]
- KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs (Sagi Shahar) [Orabug: 38359602]
- KVM: TDX: Do not retry locally when the retry is caused by invalid memslot (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Select TDX's KVM_GENERIC_xxx dependencies iff CONFIG_KVM_INTEL_TDX=y (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Remove redundant __GFP_ZERO (Rong Qianfeng) [Orabug: 38359602]
- KVM: TDX: Move TDX hardware setup from main.c to tdx.c (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL (Sean Christopherson) [Orabug: 38359602]
- x86/virt/tdx: Use precalculated TDVPR page physical address (Kai Huang) [Orabug: 38359602]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Kai Huang) [Orabug: 38359602]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Kai Huang) [Orabug: 38359602]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Kai Huang) [Orabug: 38359602]
- x86/kexec: Consolidate relocate_kernel() function parameters (Kai Huang) [Orabug: 38359602]
- x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Tidy reset_pamt functions (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Eliminate duplicate code in tdx_clear_page() (Adrian Hunter) [Orabug: 38359602]
- x86/sev: Disable ftrace branch profiling in SEV startup code (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (David Woodhouse) [Orabug: 38359602]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Rafael J. Wysocki) [Orabug: 38359602]
- x86/kexec: Mark machine_kexec() with __nocfi (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Nathan Chancellor) [Orabug: 38359602]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use correct swap page in swap_pages function (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Disable global pages before writing to control page (David Woodhouse) [Orabug: 38359602]
- x86/sev: Don't hang but terminate on failure to remap SVSM CA (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Avoid WARN()s and panic()s in early boot code (Ard Biesheuvel) [Orabug: 38359602]
- x86/sev: Disable UBSAN on SEV code that may execute very early (Ard Biesheuvel) [Orabug: 38359602]
- x86/boot/64: Fix spurious undefined reference when CONFIG_X86_5LEVEL=n, on GCC-12 (Ard Biesheuvel) [Orabug: 38359602]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up register usage in relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Drop page_list argument from relocate_kernel() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Add data section to relocate_kernel (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Move relocate_kernel to kernel .data section (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Only swap pages for ::preserve_context mode (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (David Woodhouse) [Orabug: 38359602]
- KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Exit to userspace for GetTdVmCallInfo (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetQuote&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs (Binbin Wu) [Orabug: 38359602]
- KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: use __always_inline for is_td_vcpu and is_td (Edward Adam Davis) [Orabug: 38359602]
- x86/tdx: mark tdh_vp_enter() as __flatten (Paolo Bonzini) [Orabug: 38359602]
- KVM: VMX: Clean up and macrofy x86_ops (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Define a VMX glue macro for kvm_complete_insn_gp() (Vishal Verma) [Orabug: 38359602]
- KVM: VMX: Move vt_apicv_pre_state_restore() to posted_intr.c and tweak name (Vishal Verma) [Orabug: 38359602]
- KVM: x86: Revert kvm_x86_ops.mem_enc_ioctl() back to an OPTIONAL hook (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally for KVM_PROFILING (Adrian Hunter) [Orabug: 38359602]
- KVM: x86: Do not use kvm_rip_read() unconditionally in KVM tracepoints (Adrian Hunter) [Orabug: 38359602]
- x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (Vishal Annapurve) [Orabug: 38359602]
- x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (Kirill A. Shutemov) [Orabug: 38359602]
- Documentation/virt/kvm: Document on Trust Domain Extensions (TDX) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make TDX VM type supported (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: KVM: TDX: Always honor guest PAT on TDX enabled guests (Yan Zhao) [Orabug: 38359602]
- KVM: x86: remove shadow_memtype_mask (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Introduce supported_quirks to block disabling quirks (Yan Zhao) [Orabug: 38359602]
- KVM: x86: Allow vendor code to disable quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: do not allow re-enabling quirks (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Enable guest access to MTRR MSRs (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add a method to ignore hypercall patching (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Ignore setting up mce (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore VMX preemption timer (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add method to ignore guest instruction emulation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore accesses to CPU state (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;GetTdVmCallInfo&gt; hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enable guest access to LMCE related MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV rdmsr/wrmsr hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement callbacks for MSR operations (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move KVM_MAX_MCE_BANKS to header file (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV HLT hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV CPUID hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Kick off vCPUs when SEAMCALL is busy during TD page removal (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Retry locally in TDX EPT violation handler on RET_PF_RETRY (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle EPT violation/misconfig exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXIT_REASON_OTHER_SMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle EXCEPTION_NMI and EXTERNAL_INTERRUPT (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Add a helper for NMI handling (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Move emulation_required to struct vcpu_vt (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Add methods to ignore virtual apic related operation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Force APICv active for TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Enforce KVM_IRQCHIP_SPLIT for TDX guests (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Always block INIT/SIPI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle SMI request as !CONFIG_KVM_SMM (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement methods to inject NMI (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Wait lapic expire when timer IRQ was injected (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Assume timer IRQ was injected if APIC state is protected (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Implement non-NMI interrupt injection (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move posted interrupt delivery code to common header (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Disable PI wakeup for IPIv (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add support for find pending IRQ in a protected local APIC (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV MMIO hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Handle TDX PV port I/O hypercall (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;ReportFatalError&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle TDG.VP.VMCALL&lt;MapGPA&gt; (Binbin Wu) [Orabug: 38359602]
- KVM: TDX: Handle KVM hypercall with TDG.VP.VMCALL (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add a place holder to handle TDX VM exit (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Move pv_unhalted check out of kvm_vcpu_has_events() (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Have ____kvm_emulate_hypercall() read the GPRs (Binbin Wu) [Orabug: 38359602]
- KVM: x86: Add a switch_db_regs flag to handle TDX's auto-switched behavior (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Save and restore IA32_DEBUGCTL (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: Disable support for TSX and WAITPKG (Adrian Hunter) [Orabug: 38359602]
- KVM: TDX: restore user ret MSRs (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Allow to update cached values in kvm_user_return_msrs w/o wrmsr (Chao Gao) [Orabug: 38359602]
- KVM: TDX: restore host xsave state when exit from the guest TD (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: vcpu_run: save/restore host state(host kernel gs) (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement TDX vcpu enter/exit path (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Move common fields of struct vcpu_{vmx,tdx} to a struct (Binbin Wu) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper to enter/exit TDX guest (Kai Huang) [Orabug: 38359602]
- KVM: TDX: Handle SEPT zap error due to page add error in premap (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Skip updating CPU dirty logging request for TDs (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Make cpu_dirty_log_size a per-VM value (Yan Zhao) [Orabug: 38359602]
- KVM: VMX: read the PML log in the same order as it was written (Maxim Levitsky) [Orabug: 38359602]
- KVM: VMX: refactor PML terminology (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Remove hwapic_irr_update() from kvm_x86_ops (Chao Gao) [Orabug: 38359602]
- KVM: x86/mmu: Add parameter "kvm" to kvm_mmu_page_ad_need_write_protect() (Yan Zhao) [Orabug: 38359602]
- KVM: Add parameter "kvm" to kvm_cpu_dirty_log_size() and its callers (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Handle vCPU dissociation (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Finalize VM initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add an ioctl to create initial guest memory (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Export kvm_tdp_map_page() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead (Yan Zhao) [Orabug: 38359602]
- KVM: TDX: Implement hook to get max mapping level of private pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Handle TLB tracking for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set per-VM shadow_mmio_value to 0 (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add setter for shadow_mmio_value (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Require TDP MMU, mmio caching and EPT A/D bits for TDX (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Set gfn_direct_bits to shared bit (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add load_mmu_pgd method for TDX (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Add accessors VMX VMCS helpers (Isaku Yamahata) [Orabug: 38359602]
- KVM: VMX: Teach EPT violation helper about private mem (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Do not enable page track for TD guest (Yan Zhao) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Implement memslot deletion for TDX (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to remove a TD private page (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to manage TDX TLB tracking (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrapper tdh_mem_sept_add() to add SEPT pages (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Register TDX host key IDs to cgroup misc controller (Zhiming Hu) [Orabug: 38359602]
- KVM: x86/mmu: Taking guest pa into consideration when calculate tdp level (Xiaoyao Li) [Orabug: 38359602]
- KVM: x86: Introduce KVM_TDX_GET_CPUID (Xiaoyao Li) [Orabug: 38359602]
- KVM: TDX: Do TDX specific vcpu initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Short-circuit all of kvm_apic_set_base() if MSR value is unchanged (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack msr_data structure prior to calling kvm_apic_set_base() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Make kvm_recalculate_apic_map() local to lapic.c (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename APIC base setters to better capture their relationship (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Short-circuit all kvm_lapic_set_base() if MSR value isn't changing (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: create/free TDX vcpu structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Don't offline the last cpu of one package when there's TDX guest (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Make pmu_intel.c ignore guest TD case (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: add ioctl to initialize VM with TDX specific parameters (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: expose cpuid_entry2_find for TDX (Paolo Bonzini) [Orabug: 38359602]
- KVM: TDX: Support per-VM KVM_CAP_MAX_VCPUS extension check (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: create/destroy VM structure (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get system-wide info about TDX module on initialization (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add place holder for TDX VM specific mem_enc_op ioctl (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add helper functions to print TDX SEAMCALL error (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add TDX "architectural" error codes (Sean Christopherson) [Orabug: 38359602]
- KVM: TDX: Define TDX architectural definitions (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Add placeholders for TDX VM/vCPU structures (Isaku Yamahata) [Orabug: 38359602]
- KVM: TDX: Get TDX global information (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Initialize TDX during KVM module load (Kai Huang) [Orabug: 38359602]
- KVM: VMX: Refactor VMX module init/exit functions (Kai Huang) [Orabug: 38359602]
- KVM: Export hardware virtualization enabling/disabling functions (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Add tdx_guest_keyid_alloc/free() to alloc and free TDX guest KeyID (Isaku Yamahata) [Orabug: 38359602]
- x86/virt/tdx: Read essential global metadata for KVM (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: allocate tdx_sys_info in static memory (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX flush operations (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX VM/vCPU field access (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX page cache management (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX vCPU creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX TD creation (Rick Edgecombe) [Orabug: 38359602]
- x86/virt/tdx: Add SEAMCALL wrappers for TDX KeyID management (Rick Edgecombe) [Orabug: 38359602]
- asm-generic: add an optional pfn_valid check to page_to_phys (Christoph Hellwig) [Orabug: 38359602]
- asm-generic: provide generic page_to_phys and phys_to_page implementations (Christoph Hellwig) [Orabug: 38359602]
- KVM: x86: Add infrastructure for secure TSC (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Push down setting vcpu.arch.user_set_tsc (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: move vm_destroy callback at end of kvm_arch_destroy_vm (Paolo Bonzini) [Orabug: 38359602]
- x86/tdx: Mark message.bytes as nonstring (Kees Cook) [Orabug: 38359602]
- KVM: x86/mmu: Return RET_PF* instead of 1 in kvm_mmu_page_fault() (Yan Zhao) [Orabug: 38359602]
- KVM: x86/mmu: Prevent aliased memslot GFNs (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Don't zap valid mirror roots in kvm_tdp_mmu_zap_all() (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root types for kvm_tdp_mmu_invalidate_all_roots() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate tearing down mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate building mirror page tables (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Propagate attr_filter to MMU notifier callbacks (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Support mirror root for TDP MMU (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take root in tdp_mmu_for_each_pte() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Introduce KVM MMU root types to specify page table type (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Extract root invalid check from tdx_mmu_next_root() (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Support GFN direct bits (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/tdp_mmu: Take struct kvm in iter loops (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Make kvm_tdp_mmu_alloc_root() return void (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Add an is_mirror member for union kvm_mmu_page_role (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86/mmu: Add an external pointer to struct kvm_mmu_page (Isaku Yamahata) [Orabug: 38359602]
- KVM: x86: Add a VM type define for TDX (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86/mmu: Zap invalid roots with mmu_lock holding for write at uninit (Rick Edgecombe) [Orabug: 38359602]
- KVM: x86: Refactor __kvm_emulate_hypercall() into a macro (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Always complete hypercall via function callback (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Bump hypercall stat prior to fully completing hypercall (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move "emulate hypercall" function declarations to x86.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a helper to check for user interception of KVM hypercalls (Binbin Wu) [Orabug: 38359602]
- KVM: x86: clear vcpu-&gt;run-&gt;hypercall.ret before exiting for KVM_EXIT_HYPERCALL (Paolo Bonzini) [Orabug: 38359602]
- KVM: x86: Add interrupt injection information to the kvm_entry tracepoint (Maxim Levitsky) [Orabug: 38359602]
- KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that are enabled at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly track feature flags that require vendor enabling (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "SF" macro to "SCATTERED_F" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro for features that are synthesized into boot_cpu_data (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop superfluous host XSAVE check when adjusting guest XSAVES caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace (almost) all guest CPUID feature queries with cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access ARCH_CAPABILITIES w/o support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Reject userspace attempts to access PERF_CAPABILITIES w/o PDCM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Shuffle code to prepare for dropping guest_cpuid_has() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update guest cpu_caps at runtime for dynamic CPUID-based features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Update OS{XSAVE,PKE} bits in guest CPUID irrespective of host support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Drop unnecessary check that cpuid_entry2_find() returns right leaf (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Avoid double CPUID lookup when updating MWAIT at runtime (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on KVM support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Treat MONTIOR/MWAIT as a "partially emulated" feature (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Extract code for generating per-entry emulated CPUID information (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Initialize guest cpu_caps based on guest CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Replace guts of "governed" features with comprehensive cpu_caps (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove all direct usage of cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Move kvm_find_cpuid_entry{,_index}() up near cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Always operate on kvm_vcpu data in cpuid_entry2_find() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Remove unnecessary caching of KVM's PV CPUID base (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Clear PV_UNHALT for !HLT-exiting only when userspace sets CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2 (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that KVM emulates in software (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: AMD's IBPB is not equivalent to Intel's IBPB (Jim Mattson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that ignore host kernel support (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Harden CPU capabilities processing against out-of-scope features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Add a macro to init CPUID features that are 64-bit only (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do reverse CPUID sanity checks in __feature_leaf() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't update PV features caches when enabling enforcement capability (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Zero out PV features cache when the CPUID leaf is not present (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Account for KVM-reserved CR4 bits when passing through CR4 on VMX (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Explicitly do runtime CPUID updates "after" initial setup (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Do all post-set CPUID processing during vCPU creation (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: expose MSR_PLATFORM_INFO as a feature MSR (Paolo Bonzini) [Orabug: 38359602]
- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (Tao Su) [Orabug: 38359602]
- x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Switch to use auto-generated global metadata reading code (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use dedicated struct members for PAMT entry sizes (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Use auto-generated code to read global metadata (Paolo Bonzini) [Orabug: 38359602]
- x86/virt/tdx: Start to track all global metadata in one structure (Kai Huang) [Orabug: 38359602]
- x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better (Kai Huang) [Orabug: 38359602]
- x86/tdx: Dump attributes and TD_CTLS on boot (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Disable unnecessary virtualization exceptions (Kirill A. Shutemov) [Orabug: 38359602]
- x86/tdx: Enable CPU topology enumeration (Kirill A. Shutemov) [Orabug: 38359602]
- KVM: x86/mmu: Drop per-VM zapped_obsolete_pages list (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: Remove KVM's MMU shrinker (Vipin Sharma) [Orabug: 38359602]
- KVM: x86/mmu: WARN if huge page recovery triggered during dirty logging (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Rename make_huge_page_split_spte() to make_small_spte() (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Recover TDP MMU huge page mappings in-place instead of zapping (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Refactor TDP MMU iter need resched check (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Demote the WARN on yielded in xxx_cond_resched() to KVM_MMU_WARN_ON (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Check yielded_gfn for forward progress iff resched is needed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Batch TLB flushes when zapping collapsible TDP MMU SPTEs (David Matlack) [Orabug: 38359602]
- KVM: x86/mmu: Drop @max_level from kvm_mmu_max_mapping_level() (David Matlack) [Orabug: 38359602]
- KVM: x86: Don't emit TLB flushes when aging SPTEs for mmu_notifiers (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow arch code to elide TLB flushes when aging a young page (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set Dirty bit for new SPTEs, even if _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Dedup logic for detecting TLB flushes on leaf SPTE changes (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Stop processing TDP MMU roots for test_age if young SPTE found (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Process only valid TDP MMU roots when aging a gfn range (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use Accessed bit even when _hardware_ A/D bits are disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_dirty_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Set shadow_accessed_mask for EPT even if A/D bits disabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add a dedicated flag to track if A/D bits are globally enabled (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: WARN and flush if resolving a TDP MMU fault clears MMU-writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold mmu_spte_update_no_track() into mmu_spte_update() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop ignored return value from kvm_tdp_mmu_clear_dirty_slot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't flush TLBs when clearing Dirty bit in shadow MMU (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't force flush if SPTE update clears Accessed bit (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Fold all of make_spte()'s writable handling into one if-else (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Always set SPTE's dirty bit if it's created as writable (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Flush remote TLBs iff MMU-writable flag is cleared from RO SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: Don't grab reference on VM_MIXEDMAP pfns that have a "struct page" (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop APIs that manipulate "struct page" via pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark "struct page" accessed when zapping SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: Make kvm_follow_pfn.refcounted_page a required field (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop gfn_to_pfn() APIs now that all users are gone (Sean Christopherson) [Orabug: 38359602]
- KVM: Add support for read-only usage of gfn_to_page() (Sean Christopherson) [Orabug: 38359602]
- KVM: Convert gfn_to_page() to use kvm_follow_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Don't mark "struct page" accessed when making SPTE young (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __gfn_to_page() when copying MTE tags to/from userspace (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Use __kvm_faultin_pfn() to handle memory aborts (Sean Christopherson) [Orabug: 38359602]
- KVM: arm64: Mark "struct page" pfns accessed/dirty before dropping mmu_lock (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Use __kvm_faultin_page() to get APIC access page/pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: VMX: Hold mmu_lock until page is released when updating APIC access page (Sean Christopherson) [Orabug: 38359602]
- KVM: Move x86's API to release a faultin page to common KVM (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't mark unused faultin pages as accessed (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put refcounted pages instead of blindly releasing pfns (Sean Christopherson) [Orabug: 38359602]
- KVM: guest_memfd: Provide "struct page" as output from kvm_gmem_get_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Convert page fault paths to kvm_faultin_pfn() (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_faultin_pfn() to specifically service guest page faults (Sean Christopherson) [Orabug: 38359602]
- KVM: Move declarations of memslot accessors up in kvm_host.h (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark pages/folios dirty at the origin of make_spte() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add helper to "finish" handling a guest page fault (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add common helper to handle prefetching SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Put direct prefetched pages via kvm_release_page_clean() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Add "mmu" prefix fault-in helpers to free up generic names (Sean Christopherson) [Orabug: 38359602]
- KVM: x86: Don't fault-in APIC access page during initial allocation (Sean Christopherson) [Orabug: 38359602]
- KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default (Sean Christopherson) [Orabug: 38359602]
- KVM: Get writable mapping for __kvm_vcpu_map() only when necessary (Sean Christopherson) [Orabug: 38359602]
- KVM: Pass in write/dirty to kvm_vcpu_map(), not kvm_vcpu_unmap() (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Mark vmcs12's APIC access page dirty when unmapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Pin (as in FOLL_PIN) pages during kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Migrate kvm_vcpu_map() to kvm_follow_pfn() (David Stevens) [Orabug: 38359602]
- KVM: pfncache: Precisely track refcounted pages (Sean Christopherson) [Orabug: 38359602]
- KVM: Move kvm_{set,release}_page_{clean,dirty}() helpers up in kvm_main.c (Sean Christopherson) [Orabug: 38359602]
- KVM: Provide refcounted page as output field in struct kvm_follow_pfn (Sean Christopherson) [Orabug: 38359602]
- KVM: Use plain "struct page" pointer instead of single-entry array (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Drop pointless msr_bitmap_map field from struct nested_vmx (Sean Christopherson) [Orabug: 38359602]
- KVM: nVMX: Rely on kvm_vcpu_unmap() to track validity of eVMCS mapping (Sean Christopherson) [Orabug: 38359602]
- KVM: Use NULL for struct page pointer to indicate mremapped memory (Sean Christopherson) [Orabug: 38359602]
- KVM: Explicitly initialize all fields at the start of kvm_vcpu_map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Remove pointless sanity check on @map param to kvm_vcpu_(un)map() (Sean Christopherson) [Orabug: 38359602]
- KVM: Introduce kvm_follow_pfn() to eventually replace "gfn_to_pfn" APIs (David Stevens) [Orabug: 38359602]
- KVM: Drop unused "hva" pointer from __gfn_to_pfn_memslot() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Drop kvm_page_fault.hva, i.e. don't track intermediate hva (Sean Christopherson) [Orabug: 38359602]
- KVM: Replace "async" pointer in gfn=&gt;pfn with "no_wait" and error code (David Stevens) [Orabug: 38359602]
- KVM: Drop extra GUP (via check_user_page_hwpoison()) to detect poisoned page (Sean Christopherson) [Orabug: 38359602]
- KVM: Return ERR_SIGPENDING from hva_to_pfn() if GUP returns -EGAIN (Sean Christopherson) [Orabug: 38359602]
- KVM: Annotate that all paths in hva_to_pfn() might sleep (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop @atomic param from gfn=&gt;pfn and hva=&gt;pfn APIs (Sean Christopherson) [Orabug: 38359602]
- KVM: Rename gfn_to_page_many_atomic() to kvm_prefetch_pages() (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Use gfn_to_page_many_atomic() when prefetching indirect PTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark page/folio accessed only when zapping leaf SPTEs (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark folio dirty when creating SPTE, not when zapping/modifying (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Mark new SPTE as Accessed when synchronizing existing SPTE (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Invert @can_unsync and renamed to @synchronizing (Sean Christopherson) [Orabug: 38359602]
- KVM: x86/mmu: Don't overwrite shadow-present MMU SPTEs when prefaulting (Sean Christopherson) [Orabug: 38359602]
- KVM: Add kvm_release_page_unused() API to put pages that KVM never consumes (Sean Christopherson) [Orabug: 38359602]
- KVM: Allow calling kvm_release_page_{clean,dirty}() on a NULL page pointer (Sean Christopherson) [Orabug: 38359602]
- KVM: Drop KVM_ERR_PTR_BAD_PAGE and instead return NULL to indicate an error (Sean Christopherson) [Orabug: 38359602]
- NFSD: release read access of nfs4_file when a write delegation is returned (Dai Ngo) [Orabug: 38512200]
- NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE (Dai Ngo) [Orabug: 38512200]
- nfsd: implement OPEN_ARGS_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION (Jeff Layton) [Orabug: 38512200]
- nfsd: handle delegated timestamps in SETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for delegated timestamps (Jeff Layton) [Orabug: 38512200]
- nfsd: rework NFS4_SHARE_WANT_* flag handling (Jeff Layton) [Orabug: 38512200]
- nfsd: add support for FATTR4_OPEN_ARGUMENTS (Jeff Layton) [Orabug: 38512200]
- nfsd: prepare delegation code for handing out *_ATTRS_DELEG delegations (Jeff Layton) [Orabug: 38512200]
- nfsd: rename NFS4_SHARE_WANT_* constants to OPEN4_SHARE_ACCESS_WANT_* (Jeff Layton) [Orabug: 38512200]
- nfsd: switch to autogenerated definitions for open_delegation_type4 (Jeff Layton) [Orabug: 38512200]
- nfs_common: make include/linux/nfs4.h include generated nfs4_1.h (Jeff Layton) [Orabug: 38512200]
- nfsd: fix handling of delegated change attr in CB_GETATTR (Jeff Layton) [Orabug: 38512200]
- nfsd: have nfsd4_deleg_getattr_conflict pass back write deleg pointer (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the nfsd4_fattr_args "size" field (Jeff Layton) [Orabug: 38512200]
- nfsd: drop the ncf_cb_bmap field (Jeff Layton) [Orabug: 38512200]
- tls: skip setting sk_write_space on rekey (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add rekey tests (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add key_generation argument to tls_crypto_info_init (Sabrina Dubroca) [Orabug: 38295472]
- selftests: tls: add a selftest for wrapping rec_seq (Sabrina Dubroca) [Orabug: 38295472]
- docs: tls: document TLS1.3 key updates (Sabrina Dubroca) [Orabug: 38295472]
- tls: add counters for rekey (Sabrina Dubroca) [Orabug: 38295472]
- tls: implement rekey for TLS1.3 (Sabrina Dubroca) [Orabug: 38295472]
- tls: block decryption when a rekey is pending (Sabrina Dubroca) [Orabug: 38295472]
- uek-rpm: Enable few more options in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Run savedefconfig for UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable MODULE_UNLOAD_TAINT_TRACKING in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable DAMON_RECLAIM in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable BLK_CGROUP_IOLATENCY in UEK8U2 (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable multiple compression techniques with ZRAM (Harshit Mogalapalli) [Orabug: 38488528]
- uek-rpm: Enable SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU in UEK8 (Harshit Mogalapalli) [Orabug: 38488528]
- tools/selftests: add guard region test for /proc/$pid/pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- fs/proc/task_mmu: add guard region bit to pagemap (Lorenzo Stoakes) [Orabug: 38456071]
- tools/testing/selftests: fix guard region test tmpfs assumption (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: add file/shmem-backed mapping guard region tests (Lorenzo Stoakes) [Orabug: 38456071]
- tools/selftests: expand all guard region tests to file-backed (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: rename guard-pages to guard-regions (Lorenzo Stoakes) [Orabug: 38456071]
- mm: allow guard regions in file-backed and read-only mappings (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add fork CoW guard page test (Lorenzo Stoakes) [Orabug: 38456071]
- selftests/mm: add self tests for guard page feature (Lorenzo Stoakes) [Orabug: 38456071]
- tools: testing: update tools UAPI header for mman-common.h (Lorenzo Stoakes) [Orabug: 38456071]
- mm: madvise: implement lightweight guard page mechanism (Lorenzo Stoakes) [Orabug: 38456071]
- mm: add PTE_MARKER_GUARD PTE marker (Lorenzo Stoakes) [Orabug: 38456071]
- mm: pagewalk: add the ability to install PTEs (Lorenzo Stoakes) [Orabug: 38456071]
- uek-rpm: T93: build OcteonTX2 SPI controller (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix compile errors and warnings (Dave Kleikamp) [Orabug: 38474944]
- drivers: spi: octeontx2: Fix typo in return code (Suneel Garapati) [Orabug: 38474944]
- drivers: spi: octeontx2: ACPI support for SPI driver (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Resolve issues detected in static code analysis (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Add fix for hw issue (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: use read after write for MPI_CFG (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: set tritx in config register (Piyush Malgujar) [Orabug: 38474944]
- drivers: spi: octeontx2: Support for octeontx2 spi controller (Piyush Malgujar) [Orabug: 38474944]
- uek-rpm: Build T93 smartnic kernel (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: T93: add modules.yaml.S.emb and denylist.txt.S.emb (Dave Kleikamp) [Orabug: 38474944]
- uek-rpm: Add config file for T93 smartnic (Dave Kleikamp) [Orabug: 38474944]
- iommu/arm-smmu-v3: Force 32 byte command queue memory reads (Srokade) [Orabug: 38474944]
- uek-rpm: build embedded4 kernel (Joseph Dobosenski) [Orabug: 38097144]
- uek-rpm: add UEK8 kconfig for embedded4 platform (Joseph Dobosenski) [Orabug: 38097144]
- irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38097144]
- mmc: core: Use HPI to interrupt lengthy cache flush (#495) (Brad Larson) [Orabug: 38097144]
- i2c: designware: Support stuck SDA line recovery (Brad Larson) [Orabug: 38097144]
- perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38097144]
- arm64: Enable platform SError handler (Brad Larson) [Orabug: 38097144]
- spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38097144]
- rtc: elbacpld: Support RTC in AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- mfd: Add AMD Pensando system controller (Brad Larson) [Orabug: 38097144]
- EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver (Brad Larson) [Orabug: 38097144]
- mtd: spi-nor: winbond: Add support for W25Q02NW (Brad Larson) [Orabug: 38097144]
- irqchip/pensando: Add AMD Pensando IRQ driver (Brad Larson) [Orabug: 38097144]
- arm64: Add AMD Pensando UIO support (Brad Larson) [Orabug: 38097144]
- arm64: defconfig: Add AMD Pensando defconfig (Brad Larson) [Orabug: 38097144]
- soc/pensando: Add AMD Pensando SoC drivers (Brad Larson) [Orabug: 38097144]
- arm64: dts: Add AMD Pensando SoC support (Brad Larson) [Orabug: 38097144]
- i2c: rd1173: Add Lattice SPI to I2C bus driver (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/tps53679) Add support for tps53659 (Brad Larson) [Orabug: 38097144]
- hwmon: (pmbus/ltc2978) Add support for ltc3888 (Brad Larson) [Orabug: 38097144]
- mmc: sdhci-cadence: Support ADMA with bounce buffers (Brad Larson) [Orabug: 38097144]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.26.el10uek]" date="1772193600">- pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
- pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
- pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
- pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
- x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
- ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
- rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
- uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
- Revert "NFS: Avoid changing nlink when file removes and attribute updates race" (Samasth Norway Ananda) [Orabug: 38925844]
- crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
- uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
- fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
- alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
- alloc_tag: avoid current-&gt;alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
- mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
- uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
- selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
- selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
- Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
- LTS version: v6.12.74 (Jack Vogel)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
- f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
- f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) [Orabug: 39103202] {CVE-2026-23266}
- cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
- mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
- mm/hugetlb: fix copy_hugetlb_page_range() to use -&gt;pt_share_count (Jane Chu)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
- drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
- tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey) [Orabug: 39131086] {CVE-2026-23390}
- ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
- ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
- ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
- bnxt_en: Change FW message timeout warning (Michael Chan)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
- LTS version: v6.12.73 (Jack Vogel)
- Revert "driver core: enforce device_lock for driver_match_device()" (Greg Kroah-Hartman)
- LTS version: v6.12.72 (Jack Vogel)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
- erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
- scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
- driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
- LTS version: v6.12.71 (Jack Vogel)
- vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
- io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
- LTS version: v6.12.70 (Jack Vogel)
- gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
- ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
- spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
- ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
- ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
- drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
- drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
- net: gro: fix outer network offset (Paolo Abeni) [Orabug: 39103144] {CVE-2026-23254}
- net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
- drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- net: don't touch dev-&gt;stats in BPF redirect paths (Jakub Kicinski)
- net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
- net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behún)
- net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
- net: sfp: pre-parse the module support (Russell King)
- net: phy: add phy_interface_copy() (Russell King)
- net: phy: add phy_interface_weight() (Russell King)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Eric Dumazet)
- smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
- platform/x86/intel/tpmi/plr: Make the file domain&lt;n&gt;/status writeable (Ricardo Neri)
- platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
- btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar) [Orabug: 39103173] {CVE-2026-23260}
- spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
- nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
- nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni) [Orabug: 39103180] {CVE-2026-23261}
- ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
- drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceição Alves)
- HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matouš Lánský)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
- btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana) [Orabug: 39103081] {CVE-2025-71268}
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
- HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
- smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
- LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
- smb/server: fix refcount leak in smb2_open() (Zhangguodong)
- md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
- LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
- block,bfq: fix aux stat accumulation destination (Shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
- tracing: Fix ftrace event field alignments (Steven Rostedt)
- procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
- KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- ublk: fix deadlock when reading partition table (Ming Lei)
- tools/power turbostat: fix GCC9 build regression (Todd Brandt)
- PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) [Orabug: 38970465] {CVE-2026-23198}
- Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (Bert Karwatzki) [Orabug: 39103191] {CVE-2026-23264}
- mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu) [Orabug: 39103187] {CVE-2026-23262}
- ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weißschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
- mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
- pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-&gt;domains (Xu Yang)
- pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
- pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
- pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
- pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
- LTS version: v6.12.69 (Jack Vogel)
- bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothoré)
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
- perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" (John Ogness)
- wifi: ath11k: add srng-&gt;lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
- ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
- rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
- cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
- rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 (Miguel Ojeda)
- gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
- drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
- drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
- scripts: generate_rust_analyzer: Add compiler_builtins -&gt; core dep (Tamir Duberstein)
- scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
- scripts: generate_rust_analyzer: remove sysroot assertion (Onur Özkan)
- net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
- mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
- flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
- selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
- selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
- selftests: mptcp: check no dup close events after error (Matthieu Baerts)
- mptcp: only reset subflow errors when propagated (Matthieu Baerts)
- gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
- nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
- efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
- scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
- gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
- ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
- scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
- ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
- rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target (Miguel Ojeda)
- rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
- riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
- sched/deadline: Document dl_server (Peter Zijlstra)
- dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
- bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
- bcache: use bio cloning for detached device requests (Shida Zhang)
- bcache: fix improper use of bi_end_io (Shida Zhang)
- gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
- gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
- scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
- net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
- net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
- net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
- net: bridge: fix static key check (Martin Kaiser)
- nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
- net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
- ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
- rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
- net: wwan: t7xx: fix potential skb-&gt;frags overflow in RX path (Kery Qi)
- ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
- net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
- bonding: annotate data-races around slave-&gt;last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
- octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
- net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39084048] {CVE-2026-23155}
- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
- can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
- LTS version: v6.12.68 (Jack Vogel)
- vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
- net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
- vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
- vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
- vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
- vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
- vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
- wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
- accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
- exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
- iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
- iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
- iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
- arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
- bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
- selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
- migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
- gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
- drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
- net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
- irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
- perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
- pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
- platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
- netrom: fix double-free in nr_route_frame() (Jeongjun Park)
- uacce: ensure safe queue release with state management (Chenghai Huang)
- uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
- uacce: fix isolate sysfs check condition (Chenghai Huang)
- uacce: fix cdev handling in the cleanup path (Wenkai Lin)
- s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
- mei: trace: treat reg parameter as string (Alexander Usyskin)
- intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
- tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
- slimbus: core: fix device reference leak on report present (Johan Hovold)
- slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
- octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
- arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
- arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
- wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
- wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
- wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
- ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
- iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
- iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
- iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
- iio: accel: iis328dq: fix gain values (Markus Koeniger)
- iio: accel: adxl380: fix handling of unavailable "INT1" interrupt (Francesco Lavra)
- of: platform: Use default match table for /firmware (Rob Herring)
- of: fix reference count leak in of_alias_scan() (Weigang He)
- leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
- keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
- tpm: Compare HMAC values in constant time (Eric Biggers)
- x86: make page fault handling disable interrupts properly (Cedric Xing)
- dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
- net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
- vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
- vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
- vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
- net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
- octeontx2-af: Fix error handling (Ratheesh Kannoth)
- net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
- bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
- selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
- be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramírez)
- drm/nouveau: add missing DCB connector types (Alex Ramírez)
- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
- drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
- sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
- clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
- usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
- ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
- mISDN: annotate data-race around dev-&gt;work (Eric Dumazet)
- net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
- net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
- be2net: fix data race in be_get_new_eqd (David Yang)
- net: hns3: fix data race in hns3_fetch_stats (David Yang)
- ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
- netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
- drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
- ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
- scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
- scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
- platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
- riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
- kconfig: fix static linking of nconf (Arusekk)
- regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
- spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
- interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
- iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
- mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
- comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
- x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
- arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
- arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
- scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
- Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
- w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
- w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
- comedi: dmm32at: serialize use of paged registers (Ian Abbott)
- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
- wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
- crypto: authencesn - reject too-short AAD (assoclen&lt;8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
- net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
- octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
- ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
- l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
- veth: fix data race in veth_get_ethtool_stats (David Yang)
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [Orabug: 38930985] {CVE-2026-23083}
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
- gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
- amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
- selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marlière)
- l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
- bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
- net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
- vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
- igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
- igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
- ice: Fix incorrect timeout ice_release_res() (Ding Hui)
- ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
- ice: initialize ring_stats-&gt;syncp (Jacob Keller)
- ata: libata: Print features also for ATAPI devices (Niklas Cassel)
- ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
- ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
- ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
- ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
- ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
- btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
- Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
- arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
- pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
- dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
- dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
- dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
- dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
- testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
- selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
- ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
- posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-200.74.27.el10uek]" date="1772798400">- Revert "uek-rpm: update kABI for FIPS regarding crypto_user" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "fips: remove crypto_user from the FIPS module" (Saeed Mirzamohammadi) [Orabug: 39033195]
- Revert "crypto_user: use FIPS algorithm list when FIPS module is enabled" (Saeed Mirzamohammadi) [Orabug: 39033195]
- RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
- uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
- RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
- RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
- RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
- net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]</changelog>
  <changelog author="Jack Vogel &lt;jack.vogel@oracle.com&gt; [6.12.0-201.74.1.el10uek]" date="1774267200">- selftests/bpf: Add overwrite mode test for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- bpf: Add overwrite mode for BPF ring buffer (Xu Kuohai) [Orabug: 38717758]
- uek-rpm: Ensure --with onosonly skips building container rpms (Vijay Kumar) [Orabug: 38905604]
- nvme-auth: use hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme: spelling fixes (Yi Zhang) [Orabug: 38993277]
- nvme-auth: add hkdf_expand_label() (Chris Leech) [Orabug: 38993277]
- nvme-auth: update bi_directional flag (Martin George) [Orabug: 38993277]
- nvme-auth: update sc_c in host response (Martin George) [Orabug: 38993277]
- nvme-tcp: remove redundant check to ctrl-&gt;opts (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: send only permitted commands for secure concat (Martin George) [Orabug: 38993277]
- nvme-fabrics: reset admin connection for secure concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-tcp: request secure channel concatenation (Hannes Reinecke) [Orabug: 38993277]
- nvme-keyring: add nvme_tls_psk_refresh() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_derive_tls_psk() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_digest() (Hannes Reinecke) [Orabug: 38993277]
- nvme: add nvme_auth_generate_psk() (Hannes Reinecke) [Orabug: 38993277]
- crypto,fs: Separate out hkdf_extract() and hkdf_expand() (Hannes Reinecke) [Orabug: 38993277]
- ONOS: Enable OPTOE EEPROM and ASF I2C modules (Vijay Kumar) [Orabug: 39001522]
- eeprom: optoe: drop i2c_device_id from probe() (Vijay Kumar) [Orabug: 39001522]
- ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002345]
- ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002345]
- ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002345]
- ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002345]
- ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002345]
- ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002345]
- ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002345]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021289]
- PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021289]
- uek-rpm: Turn USB_XHCI_PCI_RENESAS to a builtin option (Harshit Mogalapalli) [Orabug: 39022939]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39037823]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39037823]
- ONOS: Replace strlcpy with strscpy in bcm-hsdk-gpl (Vijay Kumar) [Orabug: 39042061]
- ONOS: Build fix for bcm-hsdk-gpl drivers (Vijay Kumar) [Orabug: 39042061]
- uek-rpm/config-x86_64-onos: Add configs for Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- bcm-hsdk-gpl: Build Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- drivers/platform: Add Broadcom HSDK GPL drivers (Vijay Kumar) [Orabug: 39042061]
- minke-fan-cpld: support partial fan insertion (Divyarajsinh Jhala) [Orabug: 39043148]
- src: scale pwm to respect pali2 cpld min pwm req (Arista-Hpandya) [Orabug: 39043148]
- src: add support for FAN-7311H-RED (Arista-Hpandya) [Orabug: 39043148]
- minke-fan-cpld: support platform specific addresses (Divyarajsinh Jhala) [Orabug: 39043148]
- drivers: add rundle support to minke fan driver (Arista-Hpandya) [Orabug: 39043148]
- driver: fix rook fan present read in cpld_init and cpld_update (Calvin Laverty) [Orabug: 39043148]
- driver: fix scd gpio active low clear (Calvin Laverty) [Orabug: 39043148]
- driver: mask_green_red --&gt; mask_red_led in scd-fan.h (Calvin Laverty) [Orabug: 39043148]
- leds: use Linux LED device classes as intended (Fraser Gordon) [Orabug: 39043148]
- amax31732: Fix error in setting primary threshold (Arista-Hpandya) [Orabug: 39043148]
- amax31732: Enable beta comp on all 4 channels (Arista-Hpandya) [Orabug: 39043148]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045033]
- uek-rpm: Enable FPROBE and FPROBE_EVENTS in UEK (Harshit Mogalapalli) [Orabug: 39050941]
- uek-rpm: T93: disable CONFIG_CPU_FREQ and CONFIG_ARM_SCMI_CPUFREQ (Thomas Tai) [Orabug: 39052955]
- mailbox: mvl-mhu: Refactor MHU RX interrupt handling (George Cherian) [Orabug: 39052955]
- driver: mmc: ACPI support added for eMMC driver for T9x. (Piyush Malgujar) [Orabug: 39052955]
- driver: mmc: Resolve issues reported by static analysis (Wojciech Bartczak) [Orabug: 39052955]
- driver: marvell: mmc: Removes static variables in tuning code (Wojciech Bartczak) [Orabug: 39052955]
- mmc: cavium: Add MMC polling method to support kmsg panic/oops write (Bhaskara Budiredla) [Orabug: 39052955]
- drivers: mmc: cleanup mmc_oops driver (Bhaskara Budiredla) [Orabug: 39052955]
- driver: mmc: Adds CMD tuning for eMMC HS200 mode (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Cleans up mmc code and prepare it for HS200 tuning update (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds device tree entries to control eMMC input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds a way to dynamically control eMMC bus input timings (Wojciech Bartczak) [Orabug: 39052955]
- driver: mmc: Adds new overrides for eMMC bus output timings (Wojciech Bartczak) [Orabug: 39052955]
- octeontx2: mmc: Adds mechanism to modify output timings for MMC bus (Wojciech Bartczak) [Orabug: 39052955]
- drivers: mmc: enables mmc polling for pstore path (Bhaskara Budiredla) [Orabug: 39052955]
- mmc: octeontx2: fix handling calibration glitch (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Configure flags for T96 pass B0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Use flags for hardware differences (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: Fix tuning for T96 C0 (Chandrakala Chavva) [Orabug: 39052955]
- mmc: octeontx2: Add tuning support for HS400 mode (Aaron Williams) [Orabug: 39052955]
- mmc: octeontx2: speed limit for tx2-c0 (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: use calibrated timing taps (Peter Swain) [Orabug: 39052955]
- mmc: cavium: do not drop bus lock in tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: slot switch by vqmmc/gpio (Peter Swain) [Orabug: 39052955]
- mmc: cavium: reorganize before vqmmc switching (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cmd and data out values fixture (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: amend hs400 tuning (Peter Swain) [Orabug: 39052955]
- mmc: cavium: correct clock divisor (Peter Swain) [Orabug: 39052955]
- mmc: cavium: fix swiotlb buffer is full (Peter Swain) [Orabug: 39052955]
- mmc: cavium: avoid single-slot startup issues (Peter Swain) [Orabug: 39052955]
- mmc: cavium: execute_tuning for octeontx2 (Peter Swain) [Orabug: 39052955]
- mmc: cavium: track &amp; apply CMD6 bus changes ASAP (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: cn96xx HS200-8wide-100MHz (Peter Swain) [Orabug: 39052955]
- mmc: cavium: CMD19/21 type correction (Peter Swain) [Orabug: 39052955]
- mmc: cavium: skip unavailable slots (Peter Swain) [Orabug: 39052955]
- mmc: cavium: finish_dma_single() should teardown/unmap (Peter Swain) [Orabug: 39052955]
- mmc: octeontx2: use device tree entries (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc tuning for delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: calibrate tap delay (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: incorporate hw interface io ctl params (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: interrupt addition for ncb fault (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: emmc operation limited to 100 MHz (Sujeet Baranwal) [Orabug: 39052955]
- mmc: cavium: Use proper register to clear interrupts (Chandrakala Chavva) [Orabug: 39052955]
- mmc: cavium: fix shutdown deadlock with active sd-card (Peter Swain) [Orabug: 39052955]
- mmc: cavium: Configure sample command and data directly (Sujeet Baranwal) [Orabug: 39052955]
- mmc: octeontx2: add check for 8/9xxx chips (Sujeet Baranwal) [Orabug: 39052955]
- uek-rpm: T93: Configure EDAC &amp; GHES support (Dave Kleikamp) [Orabug: 39052955]
- efi/Marvell: Work-around for bootefi memmap errors (Henry Willard) [Orabug: 39052955]
- soc: marvell: Add BERT support for OTX2/CN10K (Szymon Balcerak) [Orabug: 39052955]
- EDAC/mc: Modify memory error reporting print (Jaiprakash Singh) [Orabug: 39052955]
- edac: octeontx_edac: Reduce the log level for ghes prints (George Cherian) [Orabug: 39052955]
- ras:cn10k:BCP issue fix where CE errors are read as UE in kernel (Ashwin Kumar Sundararamakrishnan) [Orabug: 39052955]
- EDAC/mc: Common print format for CE and UE error (Jaiprakash Singh) [Orabug: 39052955]
- ras:edac: Modify processor_arm structure (Jaiprakash Singh) [Orabug: 39052955]
- ras:cn10k: Add support for external abort(EA) work queue (Jaiprakash Singh) [Orabug: 39052955]
- driver: edac: octeontx: Add CRC support. (Szymon Balcerak) [Orabug: 39052955]
- drivers: octeontx-edac: Refactor work thread to have common handler (Vasyl Gomonovych) [Orabug: 39052955]
- drivers: octeontx-edac: Add gic error decoder (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: offline/poison page on fatal/UE (Wladislav Wiebe) [Orabug: 39052955]
- driver: edac: octeontx: Improvements to GIC RAS handler (Chandrakala Chavva) [Orabug: 39052955]
- edac: octeontx: Add support for GIC RAS reporting (Jayanthi Annadurai) [Orabug: 39052955]
- edac: octeontx: Add error syndrome (Jayanthi Annadurai) [Orabug: 39052955]
- driver: edac: octeontx: Init MC grain (Vasyl Gomonovych) [Orabug: 39052955]
- driver: edac: octeontx: Add revision check for new pass of the chip (Chandrakala Chavva) [Orabug: 39052955]
- EDAC: Octeon: Init SDEI (Vasyl Gomonovych) [Orabug: 39052955]
- EDAC: Octeon: Add Marvell's OcteonTx2 SoC and CN10KA SoC EDAC driver (Vasyl Gomonovych) [Orabug: 39052955]
- octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur) [Orabug: 39052955]
- octeontx2-af: add max_vfs module param (Tom Saeger) [Orabug: 39052955]
- PCI: boot time optimization (Harman Kalra) [Orabug: 39052955]
- uek-rpm: T93: enable CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE (Dave Kleikamp) [Orabug: 39052955]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065406]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065406]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065602]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065602]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065602]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065602]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065602]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065602]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 39071703]
- tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 39071703]
- uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089297]
- scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098803]</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-201.74.2.el10uek]" date="1775044800">- kabi: update kABI files for FIPS (Saeed Mirzamohammadi) [Orabug: 38667144]
- RDMA/mlx5: Fix ucaps init error flow (Maher Sanalla) [Orabug: 38667144]
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring (Miaoqian Lin) [Orabug: 38667144]
- RDMA/ucaps: Avoid format-security warning (Arnd Bergmann) [Orabug: 38667144]
- net/mlx5: fs, fix UAF in flow counter release (Moshe Shemesh) [Orabug: 38667144,39004176] {CVE-2025-39979}
- net/mlx5: Not returning mlx5_link_info table when speed is unknown (Li Tian) [Orabug: 38667144]
- net/mlx5: CT: Use the correct counter offset (Vlad Dogaru) [Orabug: 38667144]
- net/mlx5: Reset bw_share field when changing a node's parent (Carolina Jubran) [Orabug: 38667144]
- net/mlx5e: Fix number of lanes to UNKNOWN when using data_rate_oper (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Carolina Jubran) [Orabug: 38667144]
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38667144,38773368] {CVE-2025-68209}
- net/mlx5e: Prepare for using different CQ doorbells (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Store the global doorbell in mlx5_priv (Cosmin Ratiu) [Orabug: 38667144]
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Cosmin Ratiu) [Orabug: 38667144]
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Yishai Hadas) [Orabug: 38667144]
- RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (Mark Bloch) [Orabug: 38667144]
- eth: mlx4: select PAGE_POOL (Greg Thelen) [Orabug: 38667144]
- net/mlx5e: TC, Don't offload CT commit if it's the last action (Jianbo Liu) [Orabug: 38667144]
- net/mlx5e: CT: Filter legacy rules that are unrelated to nic (Paul Blakey) [Orabug: 38667144]
- net/mlx5: Update pfnum retrieval for devlink port attributes (Shay Drory) [Orabug: 38667144]
- net/mlx5: fw reset, check bridge accessibility at earlier stage (Amir Tzin) [Orabug: 38667144]
- net/mlx5: Lag, use port selection tables when available (Mark Bloch) [Orabug: 38667144]
- net/mlx5e: TX, Utilize WQ fragments edge for multi-packet WQEs (Tariq Toukan) [Orabug: 38667144]
- net/mlx5: Start health poll after enable hca (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: LAG, reload representors on LAG creation failure (Mark Bloch) [Orabug: 38667144]
- mlxsw: spectrum_acl_bloom_filter: Workaround for some LLVM versions (Yuli Wang) [Orabug: 38667144]
- mlxsw: Add VXLAN bridge ports to same hardware domain as physical bridge ports (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Move mlxsw_sp_bridge_vxlan_join() (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum_switchdev: Add an internal API for VXLAN leave (Amit Cohen) [Orabug: 38667144]
- mlxsw: spectrum: Call mlxsw_sp_bridge_vxlan_{join, leave}() for VLAN-aware bridge (Amit Cohen) [Orabug: 38667144]
- mlxsw: Trap ARP packets at layer 2 instead of layer 3 (Amit Cohen) [Orabug: 38667144]
- net/mlx5e: Always select CONFIG_PAGE_POOL_STATS (Tariq Toukan) [Orabug: 38667144]
- net/mlx5e: Use right API to free bitmap memory (Mark Zhang) [Orabug: 38667144]
- net/mlx5: Remove NULL check before dev_{put, hold} (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Fix ethtool -N flow-type ip4 to RSS context (Maxim Mikityanskiy) [Orabug: 38667144]
- i2c: mlxbf: Use readl_poll_timeout_atomic() for polling (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5e: Expose port reset cycle recovery counter via ethtool (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Get counter group size by FW capability (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Access PHY layer counter group as other counter groups (Yael Chemla) [Orabug: 38667144]
- net/mlx5e: Ensure each counter group uses its PCAM bit (Yael Chemla) [Orabug: 38667144]
- leds: mlxcpld: Remove unused ACPI header inclusion (Andy Shevchenko) [Orabug: 38667144]
- net/mlx5: HWS, log the unsupported mask in definer (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, use list_move() instead of del/add (Yevgeny Kliteynik) [Orabug: 38667144]
- net/mlx5: HWS, remove unused code for alias flow tables (Yevgeny Kliteynik) [Orabug: 38667144]
- RDMA/mlx5: Drop access_flags from _mlx5_mr_cache_alloc() (Michael Guralnik) [Orabug: 38667144]
- RDMA/mlx5: Support optional-counters binding for QPs (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Compile fs.c regardless of INFINIBAND_USER_ACCESS config (Patrisious Haddad) [Orabug: 38667144]
- RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38667144]
- RDMA/core: Pass port to counter bind/unbind operations (Patrisious Haddad) [Orabug: 38667144]
- Revert "RDMA/ionic: Implement device stats ops" (Qing Huang) [Orabug: 38667144]
- RDMA/core: Add support to optional-counters binding configuration (Patrisious Haddad) [Orabug: 38667144]
- RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj() (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Add optional counters for RDMA_TX/RX_packets/bytes (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Add support for setting parent of nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Preserve rate settings when creating a rate node (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Introduce hierarchy level tracking on scheduling nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: Rename devlink rate parent set function for leaf nodes (Carolina Jubran) [Orabug: 38667144]
- net/mlx5: fs, add support for dest flow sampler HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add support for flow meters HWS action (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: fs, add API for sharing HWS action by refcount (Moshe Shemesh) [Orabug: 38667144]
- netdevsim: 'support' multi-buf XDP (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Avoid unnecessary use of comma operator (Simon Horman) [Orabug: 38667144]
- mmc: sdhci-of-dwcmshc: Change to dwcmshc_phy_init for reusing codes (Jaehoon Chung) [Orabug: 38667144]
- net/mlx5: Add IFC bits for PPCNT recovery counters group (Yael Chemla) [Orabug: 38667144]
- RDMA/mlx5: Expose RDMA TRANSPORT flow table types to userspace (Patrisious Haddad) [Orabug: 38667144]
- RDMA/mlx5: Check enabled UCAPs when creating ucontext (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Add support for UCAPs in context creation (Chiara Meiohas) [Orabug: 38667144]
- RDMA/mlx5: Create UCAP char devices for supported device capabilities (Chiara Meiohas) [Orabug: 38667144]
- RDMA/uverbs: Introduce UCAP (User CAPabilities) API (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: fs, add RDMA TRANSPORT steering domain support (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Query ADV_RDMA capabilities (Patrisious Haddad) [Orabug: 38667144]
- net/mlx5: Limit non-privileged commands (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Allow the throttle mechanism to be more dynamic (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5: Add RDMA_CTRL HW capabilities (Chiara Meiohas) [Orabug: 38667144]
- net/mlx5e: Properly match IPsec subnet addresses (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate address related variables to be in struct (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5: Lag, Enable Multiport E-Switch offloads on 8 ports LAG (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Enable lanes configuration when auto-negotiation is off (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Refactor link speed handling with mlx5_link_info struct (Shahar Shitrit) [Orabug: 38667144]
- net: rename netns_local to netns_immutable (Nicolas Dichtel) [Orabug: 38667144]
- RDMA/mlx5: Reorder capability check last (Christian Göttsche) [Orabug: 38667144]
- net/mlx5: Add trust lockdown error to health syndrome print function (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Expose crr in health buffer (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Log health buffer data on any syndrome (Moshe Shemesh) [Orabug: 38667144]
- net/mlx5: Remove newline at the end of a netlink error message (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Avoid a hundred -Wflex-array-member-not-at-end warnings (Gustavo A R Silva) [Orabug: 38667144]
- net/mlx5e: Symmetric OR-XOR RSS hash control (Gal Pressman) [Orabug: 38667144]
- ethtool: Symmetric OR-XOR RSS hash (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Use secs_to_jiffies() instead of msecs_to_jiffies() (Thorsten Blum) [Orabug: 38667144]
- net/mlx5: Add new health syndrome error and crr bit offset (Shahar Shitrit) [Orabug: 38667144]
- xfrm: provide common xdo_dev_offload_ok callback implementation (Leon Romanovsky) [Orabug: 38667144]
- xfrm: rely on XFRM offload (Leon Romanovsky) [Orabug: 38667144]
- net/mlx5e: Separate extended link modes request from link modes type selection (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Change eth_proto parameter naming (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Introduce ptys2ethtool_process_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Refactor ptys2ethtool_adver_link() (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Bridge, correct config option description (Cosmin Ratiu) [Orabug: 38667144]
- netdevsim: call napi_schedule from a timer context (Breno Leitao) [Orabug: 38667144]
- eth: mlx4: use the page pool for Rx buffers (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: remove the local XDP fast-recycling ring (Jakub Kicinski) [Orabug: 38667144]
- eth: mlx4: create a page pool for Rx (Jakub Kicinski) [Orabug: 38667144]
- net/mlx5: Add sensor name to temperature event message (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5: Prefix temperature event bitmap with '0x' for clarity (Shahar Shitrit) [Orabug: 38667144]
- net/mlx5e: Expose RSS via devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Add direct TIRs to devlink rx reporter diagnose (Amir Tzin) [Orabug: 38667144]
- net/mlx5e: Move RQs diagnose to a dedicated function (Amir Tzin) [Orabug: 38667144]
- mlxsw: Enable Tx checksum offload (Ido Schimmel) [Orabug: 38667144]
- net/mlx5e: Remove unused mlx5e_tc_flow_action struct (Gal Pressman) [Orabug: 38667144]
- net/mlx5: Remove stray semicolon in LAG port selection table creation (Gal Pressman) [Orabug: 38667144]
- net/mlx5e: Support FEC settings for 200G per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- ethtool: Add support for 200Gbps per lane link modes (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Generate PPS IN event on new function for shared clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Support one PTP device per hardware clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Move PPS notifier and out_work to clock_state (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add devcom component for the clock shared by functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add init and destruction functions for a single HW clock (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Change parameters for PTP internal functions (Jianbo Liu) [Orabug: 38667144]
- net/mlx5: Add helper functions for PTP callbacks (Jianbo Liu) [Orabug: 38667144]
- mlxsw: spectrum_router: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- net/mlx5: Remove unused mlx5dr_domain_sync (Dr. David Alan Gilbert) [Orabug: 38667144]
- mlx4: Remove unused functions (Dr. David Alan Gilbert) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Change register name (Vadim Pasternak) [Orabug: 38667144]
- platform: mellanox: mlx-platform: Cosmetic changes (Vadim Pasternak) [Orabug: 38667144]
- mellanox: Relocate mlx-platform driver (Vadim Pasternak) [Orabug: 38667144]
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan) [Orabug: 38667144]
- ktime: Add us_to_ktime() (David Howells) [Orabug: 38667144]
- Revert "mlx5: Fix default values in create CQ" (Qing Huang) [Orabug: 38667144]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915249]
- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
- scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 39104869]
- scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 39104869,39130773] {CVE-2026-23296}
- scsi: core: Move two statements (Bart Van Assche) [Orabug: 39104869]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121644]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153394,39159088] {CVE-2026-23401}</changelog>
  <changelog author="Sherry Yang &lt;sherry.yang@oracle.com&gt; [6.12.0-202.76.1.el10uek]" date="1775563200">- uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491]
- Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293]
- memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772]
- uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478]
- sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
- dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
- soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin)
- tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck)
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier)
- bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413}
- ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi)
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park)
- Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
- erofs: set fileio bio failed in short read case (Sheng Yong)
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443}
- kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck)
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao)
- net: macb: Introduce gem_init_rx_ring() (Kevin Hao)
- net: macb: Shuffle the tx ring before enabling tx (Kevin Hao)
- remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
- LTS version: v6.12.76 (Sherry Yang)
- Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin)
- LTS version: v6.12.75 (Sherry Yang)
- most: core: fix leak on early registration failure (Johan Hovold)
- arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier)
- xfs: fix copy-paste error in previous fix (Darrick J. Wong)
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula)
- ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor)
- NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
- tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu)
- tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu)
- fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt)
- tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu)
- net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
- arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier)
- x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel)
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong)
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini)
- cifs: some missing initializations on replay (Shyam Prasad N)
- fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann)
- fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He)
- fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
- fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin)
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao)
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian)
- function_graph: Restore direct mode when callbacks drop to one (Shengming Hu)
- atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
- net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
- procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko)
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer)
- drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li)
- io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe)
- tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
- net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao)
- net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao)
- octeontx2-af: CGX: fix bitmap leaks (Bo Sun)
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
- LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang)
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang)
- LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang)
- LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen)
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 (Miguel Ojeda)
- ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu)
- MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
- cifs: Fix locking usage for tcon fields (Shyam Prasad N)
- watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu)
- kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire)
- staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
- parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
- PCI: Fix pci_slot_trylock() error handling (Jinhui Guo)
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement)
- tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
- mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
- usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
- usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K)
- PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel)
- mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo)
- scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen)
- perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy)
- remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
- btrfs: continue trimming remaining devices on failure (Jinbaohong)
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut)
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle)
- kexec: derive purgatory entry from symbol (Li Chen)
- ocfs2: fix reflink preserve cleanup issue (Heming Zhao)
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
- mm/highmem: fix __kmap_to_page() build error (William Tambe)
- mtd: spinand: Disable continuous read during probe (David Laporte)
- iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
- vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez)
- tools: Fix bitfield dependency failure (Leo Yan)
- arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly)
- dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
- bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
- io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe)
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
- mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey)
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski)
- nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
- md/bitmap: fix GPF in write_page caused by resize race (Jack Wang)
- xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249}
- xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250}
- xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251}
- pinctrl: intel: Add code name documentation (Raag Jadav)
- PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev)
- xfs: fix remote xattr valuelblk check (Darrick J. Wong)
- xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong)
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong)
- xfs: delete attr leaf freemap entries when empty (Darrick J. Wong)
- iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra)
- mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
- mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson)
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo)
- media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard)
- xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig)
- xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
- drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain)
- drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav)
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal)
- media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
- dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
- dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka)
- reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski)
- s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
- clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
- media: i2c: ov01a10: Fix digital gain range (Mehdi Djait)
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat)
- soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin)
- soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin)
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau)
- bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold)
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed)
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
- soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
- dm: clear cloned request bio pointer when last clone bio completes (Michael Liang)
- dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
- platform/x86: ISST: Add missing write block check (Srinivas Pandruvada)
- media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao)
- media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao)
- media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
- media: ccs: Fix setting initial sub-device state (Sakari Ailus)
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
- media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
- media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
- media: i2c: ov5647: Correct pixel array offset (David Plowman)
- media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
- media: ccs: Avoid possible division by zero (Sakari Ailus)
- media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak)
- media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede)
- media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede)
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede)
- media: i2c: ov01a10: Fix analogue gain range (Hans de Goede)
- media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede)
- media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede)
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal)
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal)
- media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
- media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li)
- media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li)
- media: radio-keene: fix memory leak in error path (Shaurya Rane)
- media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard)
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak)
- media: amphion: Drop min_queued_buffers assignment (Ming Qian)
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau)
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack)
- HID: prodikeys: Check presence of pm-&gt;input_ep82 (Günther Noack)
- HID: magicmouse: Do not crash on missing msc-&gt;input (Günther Noack)
- HID: hid-pl: handle probe errors (Oliver Neukum)
- arm64: Disable branch profiling for all arm64 code (Breno Leitao)
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson)
- KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson)
- ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
- arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa)
- media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard)
- media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard)
- media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun)
- media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun)
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
- media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
- media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang)
- dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers)
- phy: qcom: edp: Make the number of clocks flexible (Abel Vesa)
- Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel)
- drm/tests: shmem: Swap names of export tests (Thomas Zimmermann)
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
- ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: Use the correct size for scontrol-&gt;ipc_control_data (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi)
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi)
- clk: renesas: rzg2l: Select correct div round macro (Chris Brandt)
- clk: renesas: rzg2l: Fix intin variable size (Chris Brandt)
- rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han)
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian)
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
- net: consume xmit errors of GSO frames (Jakub Kicinski)
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu)
- net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen)
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory)
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory)
- net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory)
- RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni)
- net: usb: pegasus: enable basic endpoint checking (Ziyi Guo)
- RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
- tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
- kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen)
- tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
- Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz)
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds)
- wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
- bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi)
- bnxt_en: Fix RSS context delete logic (Pavan Chebbi)
- net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
- net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo)
- espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim)
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa)
- ipmi: ipmb: initialise event handler read bytes (Matt Johnston)
- xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky)
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen)
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
- rtc: zynqmp: correct frequency value (Tomas Melin)
- drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung)
- arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann)
- btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai)
- drm/radeon: Add HAINAN clock adjustment (Decce6)
- spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt)
- drm/amd/display: bypass post csc for additional color spaces in dal (Clay King)
- drm/amdgpu: Add HAINAN clock adjustment (Decce6)
- ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
- drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
- drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
- drm/amd/display: Fix system resume lag issue (Tom Chung)
- drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung)
- ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
- include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy)
- thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar)
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov)
- ceph: supply snapshot context in ceph_uninline_data() (Ethanwu)
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
- fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov)
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
- fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
- iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen)
- Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
- watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov)
- binder: don't use %pK through printk (Thomas Weißschuh)
- fix it87_wdt early reboot by reporting running timer (René Rebe)
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
- serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah)
- staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter)
- usb: gadget: f_fs: Fix ioctl error handling (Sam Day)
- usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day)
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li)
- phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard)
- phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard)
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic)
- dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai)
- most: core: fix resource leak in most_register_interface error paths (Navaneeth K)
- fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois)
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung)
- serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek)
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi)
- dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay)
- 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini)
- m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
- HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng)
- clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
- mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
- remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
- mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
- mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai)
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown)
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan)
- tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
- riscv: vector: init vector context with proper vlenb (Sergey Matyukevich)
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki)
- vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar)
- scsi: buslogic: Reduce stack usage (Arnd Bergmann)
- hisi_acc_vfio_pci: update status after RAS error (Longfang Liu)
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng)
- RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
- nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
- myri10ge: avoid uninitialized variable use (Arnd Bergmann)
- PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
- PCI: Add ACS quirk for Qualcomm Hamoa &amp; Glymur (Krishna Chaitanya Chundru)
- PCI: Fix pci_slot_lock () device locking (Keith Busch)
- PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
- PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
- net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
- bnxt_en: Allow ntuple filters for drops (Joe Damato)
- wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
- wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang)
- net: sfp: add quirk for Lantech 8330-265D (Marek Behún)
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
- Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen)
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen)
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev)
- ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
- wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
- ipv4: igmp: annotate data-races around idev-&gt;mr_maxdelay (Eric Dumazet)
- gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet)
- ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo)
- wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang)
- wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang)
- wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit)
- net: usb: r8152: fix transmit queue timeout (Mingj Ye)
- openrisc: define arch-specific version of nop() (Brian Masney)
- netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal)
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
- ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
- ext4: mark group extend fast-commit ineligible (Li Chen)
- ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li)
- ext4: mark group add fast-commit ineligible (Li Chen)
- ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
- ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet)
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
- wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit)
- wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang)
- wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang)
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift)
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee)
- wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih)
- iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni)
- wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek)
- net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao)
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
- dm: remove fake timeout to avoid leak request (Ding Hui)
- dm: replace -EEXIST with -EBUSY (Daniel Gomez)
- wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith)
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith)
- wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang)
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez)
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang)
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith)
- wifi: rtw88: fix DTIM period handling when conf-&gt;dtim_period is zero (Roman Peshkichev)
- jfs: nlink overflow in jfs_rename (Jori Koolstra)
- jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
- ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai)
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn)
- ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo)
- spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari)
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan)
- power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo)
- modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
- ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
- HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera)
- hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong)
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk)
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf)
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni)
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei)
- drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart)
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni)
- gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
- ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn)
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi)
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
- HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
- media: rkisp1: Fix filter mode register configuration (Rui Wang)
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
- drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea)
- PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi)
- ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao)
- virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
- drm: Account property blob allocations to memcg (Xiao Kan)
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
- drm/amdkfd: Relax size checking during queue buffer get (Donet Tom)
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman)
- media: ipu6: Always close firmware stream (Sakari Ailus)
- media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus)
- media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus)
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede)
- media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede)
- media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus)
- media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
- media: solo6x10: Check for out of bounds chip_id (Kees Cook)
- media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek)
- media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
- drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li)
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian)
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal)
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
- drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost)
- drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin)
- drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang)
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar)
- drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin)
- drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher)
- drm/amd/display: Fix dsc eDP issue (Charlene Liu)
- drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang)
- media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne)
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich)
- media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich)
- media: omap3isp: set initial format (Hans Verkuil)
- media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
- drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
- spi: stm32: fix Overrun issue at &lt; 8bpw (Deepak Kumar)
- media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi)
- drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku)
- spi-geni-qcom: use xfer-&gt;bits_per_word for can_dma() (Jonathan Marek)
- spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek)
- drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang)
- drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao)
- gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov)
- drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal)
- parisc: Prevent interrupts during reboot (Helge Deller)
- arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
- Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin)
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li)
- pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi)
- sched/debug: Fix updating of ppos on server write ops (Joel Fernandes)
- char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
- mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
- crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang)
- PCI/MSI: Unmap MSI-X region on error (Haoxiang Li)
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
- clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
- bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov)
- bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen)
- perf/x86/cstate: Add Airmont NP (Martin Schiller)
- perf/x86/msr: Add Airmont NP (Martin Schiller)
- bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
- sparc: don't reference obsolete termio struct for TC* constants (Sam James)
- sparc: Synchronize user stack on fork and clone (Andreas Larsson)
- block: decouple secure erase size limit from discard size limit (Luke Wang)
- blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
- xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
- ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk)
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider)
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior)
- s390/perf: Disable register readout on sampling events (Thomas Richter)
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio)
- md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang)
- alpha: fix user-space corruption during memory compaction (Magnus Lindholm)
- powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang)
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao)
- ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li)
- EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab)
- APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab)
- APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab)
- EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab)
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
- rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
- arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang)
- perf/arm-cmn: Support CMN-600AE (Robin Murphy)
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
- tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
- smb: client: prevent races in -&gt;query_interfaces() (Henrique Carvalho)
- gfs2: fiemap page fault fix (Andreas Gruenbacher)
- smb: client: add proper locking around ses-&gt;iface_last_update (Henrique Carvalho)
- btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong)
- btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo)
- dlm: validate length in dlm_search_rsb_tree (Ziming Zhang)
- minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter)
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
- hfsplus: pretend special inodes as regular files (Tetsuo Handa)
- audit: add missing syscalls to read class (Jeffrey Bencteux)
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn)
- hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
- audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
- statmount: permission check should return EPERM (Bhavik Sachdev)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin)
- libperf build: Always place libperf includes first (Ian Rogers)
- libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
- perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das)
- perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran)
- perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers)
- libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa)
- perf callchain: Fix srcline printing with inlines (Ian Rogers)
- perf unwind-libdw: Fix invalid reference counts (Ian Rogers)
- perf test stat tests: Fix for virtualized machines (Thomas Richter)
- perf test stat: Update test expectations and events (Ian Rogers)
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang)
- ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang)
- dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa)
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka)
- ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
- ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
- ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
- ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
- ext4: fix e4b bitmap inconsistency reports (Yongjian Sun)
- ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
- ext4: drop extent cache when splitting extent fails (Zhang Yi)
- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi)
- ext4: don't cache extent during splitting extent (Zhang Yi)
- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi)
- ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi)
- MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
- drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner)
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova)
- x86/hyperv: Fix error pointer dereference (Ethan Tidmore)
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
- btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana)
- efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau)
- drm/xe/xe2_hpg: Fix handling of Wa_14019988906 &amp; Wa_14019877138 (Matt Roper)
- drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan)
- drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar)
- drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin)
- drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper)
- drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper)
- drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper)
- drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper)
- drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper)
- drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper)
- drm/xe: Clarify size of MMIO region (Matt Roper)
- drm/xe: Create dedicated xe_mmio structure (Matt Roper)
- drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper)
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov)
- spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu)
- drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam)
- drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf)
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam)
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux)
- drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan)
- drm/amdgpu: Use kvfr